An elections clerk identity that never touched the elections file server suddenly accessed it and then created a mailbox forwarding rule. Which hunt technique describes that sequence?

Behavioral analytics hunting looks for sequences of actions that are abnormal for an identity or asset, not a single indicator match. An elections clerk identity that never touched the elections file server, then suddenly accessed it, then created a mailbox forwarding rule is exactly that pattern: the sequence itself is the signal, even when no hash or domain IoC is present. Indicator hunting for a single known file hash would start from threat intel and would miss a valid-account abuse path that never drops a known sample. Configuration hunting for a missing patch on a kiosk inspects host state and does not describe an identity's abnormal action chain across file and email systems. Exporting raw Exchange logs to Excel to sort by subject line is not a Splunk hunt technique; it drops CIM and Enterprise Security sequence context and scales poorly for elections investigations. Exam caveat: distinguish behavioral sequence hunting from IoC matching and configuration state checks—SPLK-5001 Domain 6.1 tests that mapping when the stem describes chained abnormal actions. Operational check: reconstruct the clerk's timeline across Authentication, Endpoint, and Email data for the same identity, confirm the never-before file-server access plus forwarding-rule creation, write risk or hunt notes on that sequence, and avoid waiting for a hash before escalating.