--- name: investigating-insider-threat-indicators-11f96637f056 description: 'Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats. ' domain: cybersecurity subdomain: soc-operations tags: - soc - insider-threat - data-exfiltration - dlp - ueba - investigation - hr-correlation version: '1.0' author: Krishna Kumar (xalgord) license: Apache-2.0 nist_csf: - DE.CM-01 - DE.AE-02 - RS.MA-01 - DE.AE-06 --- # Investigating Insider Threat Indicators ## When to Use Use this skill when: - HR refers a departing employee for monitoring during their notice period - DLP alerts indicate bulk data downloads or transfers to personal storage - UEBA detects anomalous access patterns deviating significantly from peer baselines - Management reports concerns about an employee accessing sensitive data outside their role **Do not use** without proper legal authorization — insider threat investigations must be coordinated with HR, Legal, and Privacy teams before monitoring begins. ## Detection Gaps & Validation - **Low-and-slow exfiltration:** investigators anchor on a single bulk-download spike and miss the subject who pulls 50–100 files/day for weeks, each under the DLP threshold. Aggregate over 60–90 days and compare cumulative volume to the role/peer baseline, not per-day counts. - **Channel blind spots:** email + SharePoint get watched while the actual path is a personal cloud sync client, screenshots/printing, AirDrop, paste into a personal webmail draft, or copy to a phone over MTP. Confirm proxy `cloud-storage` category, Sysmon USB/`device_connect`, and print logs are all in scope before concluding "no exfil". - **Baseline poisoning / wrong peer group:** if the subject was already exfiltrating during the period used to build their "normal," anomalies vanish; comparing a Financial Analyst against an all-company baseline also hides role-abnormal access. Validate against a clean historical window and a true same-role peer cohort. - **Identity fragmentation:** activity split across `user`, `src_user`, `sender`, `SubjectUserName`, SamAccountName vs UPN vs email means the timeline is incomplete. Normalize all identifiers to one identity before judging volume. - **Validate the verdict:** correlate the data movement to a legitimate business justification (open ticket, project, manager confirmation) before escalating — bulk downloads during a sanctioned migration are not a threat. Tune out service/automation accounts and known backup jobs to cut DLP false positives, and confirm an alleged "after-hours" spike is not just a timezone/`_time` artifact. ## Prerequisites - Legal authorization and HR referral documenting investigation justification - SIEM with DLP, endpoint, email, proxy, and authentication log sources - Data Loss Prevention (DLP) system (Microsoft Purview, Symantec, Forcepoint) with policy alerts - Endpoint monitoring capability (EDR with USB/removable media logging) - HR data feed providing employment status, notice dates, and access entitlements - Chain of custody procedures for evidence preservation ## Workflow ### Step 1: Establish Investigation Scope and Legal Authorization Before any monitoring, ensure proper authorization: ``` INSIDER THREAT INVESTIGATION AUTHORIZATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Case ID: IT-2024-0089 Subject: [Employee Name] — [Department] Authorized By: [CISO / General Counsel] Referral Source: HR — Employee submitted resignation, 2-week notice Justification: Employee has access to trade secrets and customer PII Scope: Email, file access, USB, cloud storage, printing Duration: 2024-03-15 to 2024-03-29 (notice period) Privacy Review: Completed — compliant with acceptable use policy ``` ### Step 2: Build Activity Timeline from SIEM Query comprehensive activity for the subject: ```spl index=* (user="jsmith" OR src_user="jsmith" OR sender="jsmith@company.com" OR SubjectUserName="jsmith") earliest="2024-03-01" latest=now | eval event_category = case( sourcetype LIKE "%dlp%", "DLP", sourcetype LIKE "%proxy%", "Web Access", sourcetype LIKE "%email%", "Email", sourcetype LIKE "%WinEventLog%", "Endpoint", sourcetype LIKE "%o365%", "Cloud", sourcetype LIKE "%vpn%", "VPN", sourcetype LIKE "%badge%", "Physical Access", 1=1, sourcetype ) | stats count by event_category, sourcetype, _time | timechart span=1d count by event_category ``` ### Step 3: Detect Data Exfiltration Indicators **Bulk File Downloads (SharePoint/OneDrive):** ```spl index=o365 sourcetype="o365:management:activity" Operation IN ("FileDownloaded", "FileSynced") UserId="jsmith@company.com" earliest=-30d | stats count AS downloads, sum(eval(if(isnotnull(FileSize), FileSize, 0))) AS total_bytes, dc(SourceFileName) AS unique_files by UserId, SiteUrl, _time | bin _time span=1d | eval total_gb = round(total_bytes / 1073741824, 2) | where downloads > 50 OR total_gb > 1 | sort - total_gb ``` **USB/Removable Media Usage:** ```spl index=sysmon EventCode=1 Computer="WORKSTATION-JSMITH" (CommandLine="*removable*" OR CommandLine="*usb*" OR Image="*\\xcopy*" OR Image="*\\robocopy*") | table _time, Computer, User, Image, CommandLine | append [ search index=endpoint sourcetype="endpoint:device_connect" user="jsmith" device_type="removable" | table _time, user, device_name, device_serial, action ] | sort _time ``` **Email-Based Exfiltration:** ```spl index=email sourcetype="o365:messageTrace" SenderAddress="jsmith@company.com" | eval is_external = if(match(RecipientAddress, "@company\.com$"), 0, 1) | eval has_attachment = if(isnotnull(AttachmentName), 1, 0) | stats count AS total_emails, sum(is_external) AS external_emails, sum(has_attachment) AS with_attachments, sum(eval(if(is_external=1 AND has_attachment=1, 1, 0))) AS external_with_attach, sum(Size) AS total_size_bytes by SenderAddress | eval external_attach_pct = round(external_with_attach / total_emails * 100, 1) | eval total_size_mb = round(total_size_bytes / 1048576, 1) ``` **Cloud Storage Upload Detection:** ```spl index=proxy user="jsmith" (dest IN ("*dropbox.com", "*drive.google.com", "*onedrive.live.com", "*box.com", "*wetransfer.com", "*mega.nz") OR category="cloud-storage") http_method=POST | stats count AS uploads, sum(bytes_out) AS total_uploaded by user, dest, category | eval uploaded_mb = round(total_uploaded / 1048576, 1) | sort - uploaded_mb ``` ### Step 4: Analyze Access Pattern Anomalies **Accessing Sensitive Systems Outside Normal Scope:** ```spl index=auth user="jsmith" action=success earliest=-30d | stats dc(app) AS unique_apps, values(app) AS apps_accessed by user | join user type=left [ | inputlookup role_app_mapping.csv | search role="Financial Analyst" | stats values(authorized_app) AS authorized_apps by role | eval user="jsmith" ] | eval unauthorized = mvfilter(NOT match(apps_accessed, mvjoin(authorized_apps, "|"))) | where isnotnull(unauthorized) | table user, unauthorized, authorized_apps ``` **After-Hours and Weekend Activity:** ```spl index=* user="jsmith" earliest=-30d | eval hour = tonumber(strftime(_time, "%H")) | eval is_offhours = if(hour < 7 OR hour > 19, 1, 0) | eval day = strftime(_time, "%A") | eval is_weekend = if(day IN ("Saturday", "Sunday"), 1, 0) | stats count AS total, sum(is_offhours) AS offhours, sum(is_weekend) AS weekend by user | eval offhours_pct = round(offhours / total * 100, 1) | eval weekend_pct = round(weekend / total * 100, 1) ``` ### Step 5: Correlate with HR and Physical Security Data **Compare activity to resignation timeline:** ```spl | makeresults | eval user="jsmith", resignation_date="2024-03-15", last_day="2024-03-29", access_revocation="2024-03-29 17:00" | join user [ search index=* user="jsmith" earliest=-90d | bin _time span=1d | stats count AS daily_events, dc(sourcetype) AS data_sources by user, _time ] | eval phase = case( _time < relative_time(now(), "-30d"), "Normal (Pre-Resignation)", _time >= strptime(resignation_date, "%Y-%m-%d") AND _time <= strptime(last_day, "%Y-%m-%d"), "Notice Period", 1=1, "Transition" ) | chart avg(daily_events) AS avg_events by phase ``` **Badge/Physical Access Correlation:** ```spl index=badge_access employee_id="jsmith" earliest=-30d | stats count AS badge_events, values(door_name) AS doors_accessed, earliest(_time) AS first_badge, latest(_time) AS last_badge by employee_id | eval areas = mvcount(doors_accessed) ``` ### Step 6: Preserve Evidence and Document Findings Maintain chain of custody for all collected evidence: ```python import hashlib import json from datetime import datetime evidence_log = { "case_id": "IT-2024-0089", "investigator": "soc_analyst_tier2", "collection_time": datetime.utcnow().isoformat(), "items": [ { "item_id": "EV-001", "description": "Splunk export — all user activity 2024-03-01 to 2024-03-15", "file": "jsmith_activity_export.csv", "sha256": hashlib.sha256(open("jsmith_activity_export.csv", "rb").read()).hexdigest(), "collected_by": "analyst_doe", "collection_method": "Splunk search export" }, { "item_id": "EV-002", "description": "DLP alert details — 47 policy violations", "file": "dlp_alerts_jsmith.json", "sha256": hashlib.sha256(open("dlp_alerts_jsmith.json", "rb").read()).hexdigest(), "collected_by": "analyst_doe", "collection_method": "Microsoft Purview export" } ] } with open(f"evidence_log_{evidence_log['case_id']}.json", "w") as f: json.dump(evidence_log, f, indent=2) ``` ## Key Concepts | Term | Definition | |------|-----------| | **Insider Threat** | Risk posed by individuals with legitimate access who misuse it for unauthorized purposes | | **Data Exfiltration** | Unauthorized transfer of data outside the organization via email, USB, cloud, or other channels | | **DLP** | Data Loss Prevention — technology monitoring and blocking unauthorized data transfers based on content policies | | **Notice Period Monitoring** | Enhanced surveillance of departing employees during their resignation-to-departure window | | **Chain of Custody** | Documented evidence handling procedures ensuring forensic integrity for potential legal proceedings | | **Need-to-Know Violation** | Accessing information or systems beyond what is required for an employee's role or current tasks | ## Tools & Systems - **Microsoft Purview (formerly DLP)**: Data classification and loss prevention platform monitoring endpoints, email, and cloud storage - **Splunk UBA**: User behavior analytics detecting insider threat patterns through ML-based anomaly detection - **Forcepoint Insider Threat**: Dedicated insider threat detection platform with behavioral indicators and risk scoring - **DTEX InTERCEPT**: Endpoint-based insider threat detection focusing on user activity metadata collection - **Code42 Incydr**: Data risk detection platform specializing in file exfiltration monitoring across endpoints and cloud ## Common Scenarios - **Departing Employee**: Bulk download of customer lists and product roadmaps during two-week notice period - **Disgruntled Employee**: After negative performance review, employee accesses executive salary data outside their role - **Contractor Overreach**: External consultant accessing systems beyond contracted scope, downloading source code - **Account Misuse**: Employee sharing credentials with unauthorized third party for competitive intelligence - **Sabotage Indicator**: IT admin creating backdoor accounts and modifying system configurations before departure ## Output Format ``` INSIDER THREAT INVESTIGATION REPORT — IT-2024-0089 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Subject: jsmith (Financial Analyst, Finance Dept) Period: 2024-03-01 to 2024-03-15 Status: Employee resigned 2024-03-15, last day 2024-03-29 Key Findings: [HIGH] 3,847 files downloaded from SharePoint (12.4 GB) — 10x peer average [HIGH] USB device connected 14 times during notice period (0 times prior month) [HIGH] 187 emails with attachments sent to personal Gmail [MEDIUM] After-hours activity increased 340% during notice period [MEDIUM] Accessed HR salary database 3 times (not authorized for role) Timeline: Mar 01-14: Normal activity baseline (avg 150 events/day) Mar 15: Resignation submitted (activity spike to 890 events) Mar 16-17: Weekend access — 2,100 SharePoint downloads Mar 18: USB device first connected, DLP alert triggered Evidence Collected: 4 items (SHA-256 verified, chain of custody documented) Recommendation: Immediate access revocation recommended Evidence package prepared for Legal review ``` --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/soc-operations/investigating-insider-threat-indicators/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Dave AI. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Dave AI resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/soc-operations/investigating-insider-threat-indicators/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Human Resources, Legal Roles: Compliance Officer, HR Generalist, Security Engineer Specialties: Specialty not specified Tools: Dlp, Siem Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: c8db7f38c286ce7364edb38839d55a28c3e35d8acbb349d4dfa40aa5ccb4552a