# Build your own hunts.

URL: https://avispa.ai/orbitsoc/hunting/

Avispa OrbitSOC

Describe what to look for. OrbitSOC drafts the hunt, and an administrator publishes it.

Build your own hunt

Describe what to look for · Look for service accounts signing in interactively from countries we haven’t seen in the last 90 days. · Find hosts that ran encoded PowerShell and then connected to a domain first seen this week. · Check whether the indicators in this week’s intel brief appear anywhere in our proxy and DNS logs.

Service accounts signing in from new countries

Hypothesis hunt · private to your organization

1. **Hypothesis** · Actor · Unknown; credential misuse · Behavior · Interactive sign-ins by service accounts · Where · Identity sign-in logs · Evidence · A country not seen for that account in 90 days
2. **Telemetry and readiness**
  - Entra ID sign-ins · *ready*
  - Okta sign-ins · *not connected*
3. **Steps**
  1. List the service accounts · *Can prove an absence*
  2. Find their interactive sign-ins, last 30 days · *Can prove an absence*
  3. Compare each country with the account’s 90-day history · *Can’t prove an absence*
4. **Result columns** · Account · Country · First seen · Sign-in type
5. **Scoring and budget** · Rarer countries score higher. At most 20 queries a run.
6. **Schedule** · Daily
7. **Publish checklist**
  - The hypothesis names a behavior
  - It names where to look
  - The evidence is defined
  - The telemetry it needs is connected
  - Its fields are in your data
  - Every step says if it can prove an absence
  - No indicator is invented
  - A lookback is set
  - The result columns are named
  - Scoring is defined
  - A query budget is set
  - A schedule is set
  - You confirmed the read-back
  - An administrator publishes it

**Chose for you** A 30-day lookback; Service accounts named svc-\*

**Left out** Okta sign-ins: not connected

It never invents an indicator, and every step says whether it can prove an absence.

## Every day, a receipt.

Hunting calendar

Service accounts signing in from new countries

- Clean
- Found
- Missed
- Degraded

Assurance receipt · Sep 19

Found

- **Established**: Two interactive sign-ins by svc-backup from a new country. An investigation was opened.

- **Couldn’t look at**: Okta sign-ins (not connected).

A missed day is never shown as clean. Each receipt says what the run established and what it couldn’t look at.

**More: from intel to hunts, the radar and adversary profiles**

## From article to hunt.

Threat intelligence

Articles

- **Loader spread through fake browser updates** · 3 days old
- KEV · **VPN appliance flaw exploited in the wild** · 1 day old
- **Phishing kit aimed at Microsoft 365 sign-ins** · 6 days old
- **Ransomware group’s 2025 playbook** · Not searched: 45 days old

Confirmed indicators

- **4 domains, 2 IPs** · From the loader article
- **1 exploit path** · From the VPN article

Hunts

- **Loader domains in proxy and DNS** · Planned, approved
- **VPN exploitation attempts** · Planned, approved

Findings

- **1 host reached a loader domain** · Investigation opened
- **No VPN exploitation found** · Receipt published

An article becomes a hunt only when it’s fresh, has an indicator you can query and has a plan.

## Six radars for what rules miss.

Threat radars

- **Exfiltration** · Clean
- **Cloud control plane** · Clean
- **MFA-failure clusters** · 1 finding
- **Newly observed domains** · Clean
- **Service-account misuse** · 1 finding
- **File-hosting uploads** · Can’t map fields

**Correlation pass** Correlated: the same account behind both findings

A separate pass correlates findings across them. A radar that can’t map its fields says so, instead of reporting clean.

## Your threat profile, every week.

Threat profile, run weekly

**Uncharted risk** · Apply controls, keep collecting

**Critical risk** · Hunt now

**Ambient risk** · Harden the vectors

**Bounded risk** · Detect now

- Scattered Spider
- ShinyHunters
- Clop
- Akira
- Qilin
- Magecart
- Storm-0539
- Storm-1865

Strength of known pattern

Risk to a reference asset

Named public threat actors, ranked against your organization by risk and by how strong their known pattern is.

## Bring a hunt you’ve wanted to run to the demo.

[Book a demo](https://avispa.ai/book-a-demo/) · [See a live investigation · (opens orbitsoc.com)](https://www.orbitsoc.com/investigation-storyline?view=storyline)