Question 1: Network activity is often the best source of indicators when analyzi

Question 1: Network activity is often the best source of indicators when analyzing a suspected incident. It is very hard for attackers to disguise the endpoints involved in either sending commands to a malicious bot installed on a local host or transferring data out of the network.
How would you set up a simple DNS tunneling mechanism to illustrate how attackers can try to disguise communications by hiding it within a common protocol? What other tools or steps would you use to identify and capture traffic that would lead to identification of a disguised or compromised endpoint?
Question 2: part1: Why might a host-related IoC manifest as abnormal operating system (OS) process behavior rather than as a malicious process?
Part2: What are the main types of IoCs that can be identified through analysis of the Registry?
Each question 250-300 words