Avispa OrbitSOC

Build your own hunts.

Describe what to look for. OrbitSOC drafts the hunt, and an administrator publishes it.

Build your own hunt
Describe what to look for

Service accounts signing in from new countries

Hypothesis hunt · private to your organization

  1. Hypothesis
    Actor
    Unknown; credential misuse
    Behavior
    Interactive sign-ins by service accounts
    Where
    Identity sign-in logs
    Evidence
    A country not seen for that account in 90 days
  2. Telemetry and readiness
    • Entra ID sign-insready
    • Okta sign-insnot connected
  3. Steps
    1. List the service accountsCan prove an absence
    2. Find their interactive sign-ins, last 30 daysCan prove an absence
    3. Compare each country with the account’s 90-day historyCan’t prove an absence
  4. Result columns

    AccountCountryFirst seenSign-in type

  5. Scoring and budget

    Rarer countries score higher. At most 20 queries a run.

  6. Schedule

    Daily

  7. Publish checklist
    • The hypothesis names a behavior
    • It names where to look
    • The evidence is defined
    • The telemetry it needs is connected
    • Its fields are in your data
    • Every step says if it can prove an absence
    • No indicator is invented
    • A lookback is set
    • The result columns are named
    • Scoring is defined
    • A query budget is set
    • A schedule is set
    • You confirmed the read-back
    • An administrator publishes it

Section 1 of 7

Chose for you A 30-day lookback; Service accounts named svc-*

Left out Okta sign-ins: not connected

It never invents an indicator, and every step says whether it can prove an absence.

Every day, a receipt.

Hunting calendar

Service accounts signing in from new countries

  • Clean
  • Found
  • Missed
  • Degraded

Assurance receipt Sep 19

Found

Established
Two interactive sign-ins by svc-backup from a new country. An investigation was opened.
Couldn’t look at
Okta sign-ins (not connected).

A missed day is never shown as clean. Each receipt says what the run established and what it couldn’t look at.

More: from intel to hunts, the radar and adversary profiles

From article to hunt.

Threat intelligence

Articles

  • Loader spread through fake browser updates3 days old
  • KEVVPN appliance flaw exploited in the wild1 day old
  • Phishing kit aimed at Microsoft 365 sign-ins6 days old
  • Ransomware group’s 2025 playbookNot searched: 45 days old

Confirmed indicators

  • 4 domains, 2 IPsFrom the loader article
  • 1 exploit pathFrom the VPN article

Hunts

  • Loader domains in proxy and DNSPlanned, approved
  • VPN exploitation attemptsPlanned, approved

Findings

  • 1 host reached a loader domainInvestigation opened
  • No VPN exploitation foundReceipt published

An article becomes a hunt only when it’s fresh, has an indicator you can query and has a plan.

Six radars for what rules miss.

Threat radars
  • ExfiltrationClean
  • Cloud control planeClean
  • MFA-failure clusters1 finding
  • Newly observed domainsClean
  • Service-account misuse1 finding
  • File-hosting uploadsCan’t map fields

Correlation pass Correlated: the same account behind both findings

A separate pass correlates findings across them. A radar that can’t map its fields says so, instead of reporting clean.

Your threat profile, every week.

Threat profile, run weekly
Uncharted riskApply controls, keep collecting
Critical riskHunt now
Ambient riskHarden the vectors
Bounded riskDetect now
  • Scattered Spider
  • ShinyHunters
  • Clop
  • Akira
  • Qilin
  • Magecart
  • Storm-0539
  • Storm-1865

Strength of known pattern

Risk to a reference asset

Named public threat actors, ranked against your organization by risk and by how strong their known pattern is.

Bring a hunt you’ve wanted to run to the demo.

Book a demoSee a live investigation