Analysts want to hunt newly registered C2 domains used against city workstations. Where should they look first?
Select an answer to reveal the explanation.
Short Explanation
C2 domains show up where names get resolved, not where badges beep. City recursive DNS is the high-value source for "who asked for that brand-new hostname."
Full Explanation
DNS query logs from recursive resolvers are a primary source for hunting newly registered or rare domains used as command and control. They record which civic client asked for which name and when. Physical access control, receipt printers, and building-automation setpoints do not contain domain-lookup evidence. Pair DNS with proxy or firewall later, but start where the name was resolved.