Which of the following is a common method for detecting phishing attacks in threat hunting techniques?

DNS monitoring is a fundamental and highly effective threat hunting technique for detecting phishing attacks. Phishing campaigns rely on tricking users into visiting malicious websites, which requires a DNS query to resolve the fraudulent domain name. Threat hunters proactively analyze DNS logs to identify anomalies indicative of phishing, such as queries to newly registered domains (NRDs), domains using typosquatting or homoglyphs to mimic legitimate sites, or domains with unusually low Time-to-Live (TTL) values, which are common tactics used by attackers to evade detection.

B. Predictive analytics: This is a broad discipline for forecasting future events based on data models, not a direct, hands-on technique for hunting active phishing threats.

C. Asset management: This is a foundational security practice for maintaining an inventory of hardware and software; it is not an active method for detecting phishing attacks.

D. Hardware encryption: This is a data protection control that secures data at rest on a physical device and is irrelevant to the detection of network-based phishing attempts.

1. Cisco Official Documentation: Cisco. (2022). Cisco Umbrella Documentation. In the "DNS-Layer Security" section, the documentation explains how monitoring DNS requests is the first line of defense to block requests to malicious destinations, including phishing sites, before a connection is ever established. This principle is central to threat hunting using DNS data. (See Cisco Umbrella, DNS-Layer Security feature overview).

2. Peer-reviewed academic publications: Marchal, S., et al. (2017). "PhishScore: A Uniform and Extensible Framework for Evaluating Phishing Detection Methods." IEEE Transactions on Dependable and Secure Computing, 16(4), 615-628. Section III.A, "Features from URLs and Hostnames," discusses how features extracted from domain names, which are resolved via DNS, are critical inputs for phishing detection systems. This supports the concept of analyzing DNS-related data to find phishing. DOI: 10.1109/TDSC.2017.2713991

3. University Courseware: Paxson, V. (2021). CS 161: Computer Security, Lecture 18: Web Security. University of California, Berkeley. The lecture notes discuss phishing mechanisms and defenses, highlighting how attackers register deceptive domain names (e.g., paypa1.com) and how monitoring for such domains is a key defensive strategy. The resolution of these domains is handled by DNS, making its traffic a critical chokepoint for monitoring and hunting.