Off-hours administrative and reconnaissance activity (correlation overlay, corroboration-required)
Flags administrative, discovery, or reconnaissance-style actions occurring between 22:00-06:00 local time, suppressed during confirmed maintenance windows or valid on-call tickets, and requires co-occurrence with at least one other flagged detection before surfacing — a corroborating signal, not a standalone alert.
Microsoft Sentinel (KQL)
