County SOC wants to hunt clerk VPN days that do not look like a normal 9-to-5 workweek. Which technique fits?

Modeling, or anomaly hunting, compares current activity to a baseline of expected civic behavior. When a county SOC wants to hunt clerk VPN days that do not look like a normal 9-to-5 workweek, the fitting technique is to build a baseline model of normal Monday-through-Friday clerk VPN volume and then hunt days that break that model. Indicator hunting for a single known hash from last year's ransomware sample answers a different question and ignores time-of-day and workweek structure entirely. Listing every jump-host service regardless of volume or working hours is configuration hunting, which inspects host state rather than VPN volume baselines. Sweeping ISAC C2 domains without considering county working hours is indicator hunting and likewise does not encode the 9-to-5 clerk model. The analyst still investigates anomalous days with follow-on searches, but the technique that matches this prompt is anomaly modeling against the civic workweek baseline. Exam caveat: technique selection follows the question asked—baseline deviation versus IoC match versus configuration state—not whichever search is easiest to paste. Operational check: compute typical clerk VPN session counts by weekday and hour for a quiet baseline period, flag days that deviate sharply, and only then drill into those outlier days for identity and destination context before any detection promotion.