A SOC analyst reviewing EDR telemetry notices that a service account normally used by an application suddenly initiates outbound SMB connections to several file servers during a maintenance window. The account's prior activity shows no such connections, and no known indicator matches the behavior. Which hunting concept best explains how the analyst identified this activity as suspicious?

Baseline deviation is a core threat-hunting concept because it shifts attention from known indicators to expected behavior. Analysts first profile normal patterns for accounts, processes, hosts, and network flows, then search for activity that falls outside those patterns. In this scenario, the service account's new outbound SMB connections represent a change from its historical behavior, so the deviation itself is the lead even though no external threat feed confirms it. Threat intelligence indicator matching would be appropriate only if the activity aligned with known malicious domains, hashes, IPs, or campaign patterns. Signature-based malware detection would require a known malware pattern or file characteristic, not merely unusual account behavior. Vulnerability exploitability scoring helps rank weaknesses for remediation, so it does not identify suspicious runtime behavior. Exam caveat: baseline hunting can surface false positives from legitimate administrative changes, so the analyst must correlate the anomaly with tickets, maintenance windows, and authentication context. Operational check: query the SIEM for the account's last thirty days of SMB and outbound connection counts, then compare the current spike against the median and standard deviation before escalating.