No detection rule fired.
The hunt found 9 compromised hosts.

Find the attack before the alert fires.

Living-off-the-Land tradecraft uses legitimate system tools (PowerShell, certutil, bitsadmin, rundll32, cron, ld.so.preload) to execute attacker objectives without dropping recognizable malware. Signature-based detection misses it. Single-domain hunts miss it. The hunt is worth running precisely because if alerts were going to fire, they already would have.

The agent’s scope: seven-day window, two OS families, four telemetry domains (endpoint, identity, cloud, network). The intake query confirmed worst-case visibility:

Without a working status filter, the hunt’s value isn’t filtering unresolved alerts. It’s finding patterns no alert ever modeled.

Staging. Compilation. Reconnaissance. Suspected compromise.

The agent’s specialists (classifier, lotl-detector, identity-investigator, enricher) assembled a four-phase picture of an active campaign in pre-detonation staging across nine hosts.

The highest-yield query in the entire investigation was the cross-host PowerShell process_activity sweep, 380,918 characters returned, with the cvtres.exe compilation pattern present on all four Windows hosts simultaneously beginning at 2026-05-14T17:00:

The powershell.exe → cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 /OUT: C:\Windows\TEMP\RES[hex].tmp sequence with random temp filenames is the standard signature of inline C# payload compilation — Cobalt Strike, Empire, and Metasploit all produce it when using Add-Type or Invoke-Expression with embedded C# source.

Cross-boundary means cross-blind-spot.

Banking trojan on AWS, keylogger on Linux, wiper on Windows, automated enumeration on three more. That range is the cross-boundary tell. No single-domain tool sees the whole shape. The mesh-level hunt does.

Active in findings. Absent from authentication.

One signal jumped from the cross-source view: account travis.b*** appears in detection_finding (Query #22) and data_security_finding (Query #33, 1,137 chars, file-level security events). But the same account’s authentication telemetry returned 327 characters. Zero substantive auth events when queried via the actor.user.name path.

For a user actively appearing in detection and data-security events, missing authentication telemetry is itself a finding. Three explanations, all of which elevate risk:

• Log forwarding gap for the account’s source system (low risk if isolated).
• Service or machine account authenticating via Kerberos/NTLM without interactive session logging (medium risk).
• Pass-the-hash or pass-the-ticket lateral movement. No interactive auth event because the attacker is reusing a harvested token (high risk, consistent with the campaign’s enumeration phase).

The agent did not declare a verdict. It listed all three explanations, named pass-the-hash as consistent with the rest of the evidence, and recommended disabling the account while the investigation continues.