| Hunt | Hypothesis | Data | Window | Hits | Owner | Status |
|---|---|---|---|---|---|---|
| HUNT-121 | A service account signed in interactively from a workstation | Identity logs, Endpoint telemetry | 7 days | 2 | I•••• K•••• | Completed |
| HUNT-118 | A payment-message host talks to a new external IP | Firewall, DNS | 30 days | 0 | T••••• R••••• | Completed |
| HUNT-115 | Office processes launching script interpreters | Endpoint telemetry | 30 days | 6 | I•••• K•••• | Completed |
SELECT s.account, s.src_host, s.logon_type, COUNT(*) AS logons
FROM identity_signins s
JOIN directory_accounts a ON a.name = s.account AND a.kind = 'service'
WHERE s.ts > now() - interval '7 days'
AND s.logon_type IN ('interactive', 'remote_interactive')
AND s.src_host NOT IN (SELECT host FROM approved_jump_hosts)
GROUP BY 1, 2, 3 ORDER BY logons DESC;