Failed logons against a county domain controller jump to three standard deviations above that DC's own baseline, and no threat-intel hash is present. What technique is the hunter using?
Select an answer to reveal the explanation.
Short Explanation
Outliers are the coworker who suddenly badges in at 3 in the morning—weird versus their own pattern, not versus a wanted poster. Three sigma above that DC's failed-logon baseline is the hunt. A missing intel hash does not make the spike normal.
Full Explanation
Outlier detection identifies deviation from a baseline or peer group, including statistical thresholds and never-before-seen pairs. It is not the same as matching a static threat-intel indicator. Configuration hunts and Pyramid of Pain rankings are different techniques and do not explain a 3-sigma failed-logon spike with no hash.