Surfaces privileged-activity events (Level == "PrivilegedActivity") that occur outside normal business hours - before 'bizStartHourUtc', after 'bizEndHourUtc', or on a weekend - over the lookback window, with no alerting threshold applied. Privileged operations such as secret access or configuration changes performed at unusual times can indicate a compromised account, an attacker operating in a different time zone, or insider activity outside oversight. Tune the business-hours window (UTC) to your operating region.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.