b0ca02605f
* new hunt for spoofed MSFT domains * added lookback time to ESQL query
* new hunt for spoofed MSFT domains * added lookback time to ESQL query