How can DNS log artifacts assist threat hunting? Provide an example.

• A. They reveal domain lookups used by malware C2 or data exfiltration; example: repetitive queries to a single suspicious domain.
• B. They contain IP addresses only; not domain names.
• C. They are too noisy to be useful for detection.
• D. They show user browsing history; not helpful for C2.

Answer: (A)

DNS log artifacts provide visibility into how name resolution happens inside an environment, which attackers often abuse for covert communication. This makes them powerful for threat hunting because you can surface patterns that indicate malware C2 or data exfiltration driven by DNS. For example, repetitive queries to a single suspicious domain can reveal beaconing from an infected host to attacker-controlled infrastructure. By examining which internal hosts are querying which domains, how often, and what record types are used (A/AAAA/TXT, etc.), Hunters can establish a baseline of normal DNS behavior and flag anomalies such as regular, periodic lookups to unusual or high-entropy domains, or domains with anomalous TTLs that might accompany DNS tunneling or fast-flux techniques. Since DNS traffic often traverses perimeters more easily than other traffic, these artifacts become a telltale source for detecting covert C2 and data exfiltration attempts.