While conducting log reviews, Misha observed that a privileged account had 3 unsuccessful login attempts and a password reset right after. A successful login attempt happened at 3 a.m. and is an anomaly as no change window was authorized. What is being observed here?

a. Advanced persistent attack
b. Normal activity
c. Indicator of compromise (IOC)
d. Patch management