The state ISAC publishes a C2 domain tied to a campaign against municipal email. What hunting technique should the city SOC run first against Web, DNS, and firewall data?
Select an answer to reveal the explanation.
Short Explanation
Someone handed the city a domain name, so this is an IoC sweep: look it up in Web, DNS, and firewall. Fast and perishable, still a real hunt technique. Do not skip it to remodel behavior or retune CIM first.
Full Explanation
Indicator-based hunting takes a known IoC—here an ISAC C2 domain—and searches available telemetry such as Web, DNS, and firewall for matches. It is fast and the indicator will age, but it remains a valid Domain 6.1 technique. Configuration hunting and behavioral modeling answer different questions and would ignore the published domain. Rewriting CIM aliases is data-onboarding work, not the first hunt when a civic C2 indicator is already in hand.