Failed logons against a county domain controller jump to three standard deviations above that DC's own baseline, and no threat-intel hash is present. What technique is the hunter using?
Select an answer to reveal the explanation.
Short Explanation
Outliers are the coworker who suddenly badges in at 3 in the morning—weird versus their own pattern, not versus a wanted poster. Three sigma above that DC's failed-logon baseline is the hunt. A missing intel hash does not make the spike normal.
Full Explanation
Outlier detection identifies deviation from a baseline or peer group—including statistical thresholds such as three standard deviations and never-before-seen pairs—rather than matching a static threat-intel indicator. Failed logons against a county domain controller that jump to three standard deviations above that DC's own baseline, with no threat-intel hash present, are therefore an outlier-detection hunt: the signal is deviation from the host's normal failed-logon rate. Indicator-of-compromise matching against a static intel list would require a known hash or domain and would miss this baseline breach. Configuration hunting for disabled Sysmon asks a host-settings question unrelated to authentication volume outliers. Pyramid of Pain ranking of attacker tools is a prioritization framework for what to detect, not the technique that flags a 3-sigma failed-logon spike. Exam caveat: outlier detection does not require an IoC hit; empty intel does not invalidate a statistically extreme civic authentication anomaly. Operational check: establish the DC's failed-logon baseline over a quiet period, confirm the current window exceeds three standard deviations, identify source users and addresses contributing to the spike, and escalate without waiting for a hash match.