The state ISAC publishes a C2 domain tied to a campaign against municipal email. What hunting technique should the city SOC run first against Web, DNS, and firewall data?

Indicator-based hunting takes a known indicator of compromise—here a state ISAC C2 domain tied to a campaign against municipal email—and searches available telemetry such as Web, DNS, and firewall for matches. That is the first technique a city SOC should run when the indicator is already in hand: it is fast, scoped to named data sources, and directly tests whether civic systems talked to the published domain. The indicator will age and may later need enrichment or behavioral follow-up, but Domain 6.1 still treats IoC sweeps as a valid hunt. Configuration hunting for disabled Sysmon on jump hosts only answers a host-state question and deliberately ignores the published domain. Long-term behavioral modeling with no use of the published domain discards the best current knowledge the ISAC just provided. Rewriting CIM Web data model field aliases before any hunt begins is data-onboarding or engineering work, not the first hunt when a civic C2 indicator is already available. Exam caveat: when an ISAC publishes an IoC, start with indicator hunting across the relevant CIM data; do not postpone the sweep for modeling or CIM redesign. Operational check: search Web, DNS, and firewall sourcetypes for the exact C2 domain (and related URL or IP if provided), pivot any hits to affected civic identities and assets, and document presence or absence before deciding whether to promote a lasting detection.