County SOC wants to hunt clerk VPN days that do not look like a normal 9-to-5 workweek. Which technique fits?
Select an answer to reveal the explanation.
Short Explanation
If the question is what does a normal clerk VPN week look like, that is modeling. Baseline Monday-through-Friday volume, then hunt the days that break it. A hash or C2 sweep answers a different question.
Full Explanation
Modeling, or anomaly hunting, compares current activity to a baseline of expected civic behavior. County clerk VPN volume that is normally 9-to-5 is the model; days that break it are the hunt. Indicator hunting for a hash or C2 domain and configuration hunting for jump-host services do not encode that time-of-day baseline. The analyst still investigates hits, but the technique that matches this question is anomaly modeling.