Webmail-to-virtualization-cluster credential pivot (tight window, admin/maintenance exclusions)
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Microsoft Sentinel (KQL)
