Insider threats are uniquely difficult because the actor has legitimate credentials — no failed logins, no exploit, no malware. The signal is behavioural: bulk downloads from a normal user, after-hours access by someone who's never worked weekends, copying source code to a USB the day after resignation, mass-forwarding mail to a personal address.
Detection requires Microsoft Purview Insider Risk Management or equivalent UEBA, fused with DLP signals, file-server audit, and EDR USB telemetry. Crucially, insider response is a multi-discipline workflow: Legal and HR own the decision tree, SOC owns the evidence. Acting without Legal/HR approval can compromise both the investigation and any subsequent termination or prosecution.
◈ Table of Contents
01
Background
CONTEXTB1Insider Threat Categories & MITRE Mapping
| Category | MITRE | Key Indicator | Severity |
|---|---|---|---|
| IP / Source code theft | T1052.001 (Removable Media), T1567.002 (Cloud Storage) | git clone / mass download of repos; copy to USB / personal cloud right before resignation | CRITICAL |
| Customer data exfiltration | T1530 (Data from Cloud Storage) | Bulk export from CRM / data warehouse / customer DB outside normal role pattern | CRITICAL |
| Privilege misuse / snooping | T1078 (Valid Accounts) | Privileged user accessing colleague mailboxes, HR data, exec calendars without ticket | HIGH |
| Sabotage / data destruction | T1485 (Data Destruction) | Mass file deletion, repository force-push wiping history, backup tampering | CRITICAL |
| Collusion with external actor | T1199 (Trusted Relationship) | Insider granting access, sharing creds, or forwarding privileged info to outsider | CRITICAL |
| Negligent (not malicious) | — | Unencrypted laptop loss, sensitive file shared to "Everyone" link, mistaken bulk email | MEDIUM |
B2Log Sources & Tooling
| Source | Table / Portal | Key Events |
|---|---|---|
| Microsoft Purview Insider Risk Mgmt (IRM) | compliance.microsoft.com → Insider Risk Mgmt | Data exfil policies (USB, cloud, email, print), departure indicators, sequence detections |
| Microsoft Purview DLP | OfficeActivity (RecordType=DLP), DLPEvents | Policy match on PCI/PII/IP; channel = email, OneDrive, Teams, endpoint |
| Defender for Endpoint — USB / removable | DeviceEvents (ActionType has "Usb") | UsbDriveMounted, UsbDriveDriveLetterChanged, files copied to removable |
| File server / SharePoint audit | OfficeActivity, file server SACL | Bulk download, mass open, unusual access path |
| HR signals (out-of-band) | HR system — not SOC tool | Resignation tendered, PIP active, performance dispute, contractor end-date |
HR data is the most predictive insider-threat signal — and the one SOC analysts cannot see directly. Establish a privacy-respecting handshake with HR: they flag "elevated-monitoring" employees by ID; the SOC raises sensitivity on those identities in IRM without seeing the HR context.
02
Identification
INVESTIGATEInsider Threat — Investigation Workflow
I1Bulk Download / Data StagingKQL
KQL — Sentinel: SharePoint / OneDrive bulk download
// User downloads > 200 files or > 500MB in 24h
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed")
| summarize FileCount=dcount(OfficeObjectId), TotalBytes=sum(toint(column_ifexists("UserAgent_d", 0)))
by UserId, bin(TimeGenerated, 24h)
| where FileCount > 200
| order by FileCount desc
KQL — Endpoint: mass file copy to USB
DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType in ("UsbDriveMounted", "UsbDriveDriveLetterChanged")
| join kind=inner (
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath matches regex @"^[D-Z]:\\" // removable drive letters
) on DeviceId
| summarize FileCount=count(), FileTypes=make_set(tostring(FileName), 20)
by DeviceName, InitiatingProcessAccountName, USB=tostring(AdditionalFields)
| where FileCount > 50
I2Personal Cloud / Email ExfiltrationKQL
KQL — Uploads to personal cloud domains
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (
"drive.google.com", "dropbox.com", "mega.nz", "wetransfer.com",
"pcloud.com", "icloud.com", "personal.box.com", "send.tresorit.com"
)
| where ActionType == "ConnectionSuccess"
| summarize Hits=count(), BytesSent=sum(toint(SentBytes))
by InitiatingProcessAccountName, DeviceName, RemoteUrl, bin(TimeGenerated, 1h)
| where BytesSent > 50000000 // > 50 MB
| order by BytesSent desc
KQL — Mass forward to external personal address
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation == "Send" and RecordType == "ExchangeItem"
| extend Recipients = tostring(parse_json(Item).Recipients)
| where Recipients has_any ("@gmail.com", "@outlook.com", "@yahoo.com", "@proton.me", "@hotmail.com", "@icloud.com")
| where UserId !endswith "@yourdomain.com" // adjust to your own domain check
| summarize Count=count() by UserId, bin(TimeGenerated, 1d)
| where Count > 10
I3FP vs TP Decision Gate
| True-Positive Signals | False-Positive Signals |
|---|---|
| Bulk download of repos / customer data within 30 days of resignation | Researcher pulling open-source repos for legitimate work |
| Sensitive files copied to USB during off-hours from non-admin user | Field engineer copying installer/driver to USB for client site |
| Mass mail forward to personal address; subject lines reference IP / customer / pricing | User using personal mail as MFA backup notification (rare; still policy-violation, not theft) |
| Access to colleagues' mailboxes / HR files without business case | Authorized e-discovery search by Compliance Officer |
03
Containment
STOP ITC1Containment — Requires HR / Legal Approval FirstCoordinated
For confirmed-malicious insider activity, do NOT unilaterally lock the account or notify the user. Premature action tips them off, lets them destroy evidence, and creates legal exposure. Engage HR + Legal first; they decide timing.
- 1Engage HR + Legal channel: Open evidence-only ticket. Provide DLP/IRM alerts, file lists, timeline. Wait for their go-ahead before any user-impacting action.
- 2Apply Litigation Hold on mailbox & OneDrive:
Set-Mailbox [UPN] -LitigationHoldEnabled $true— preserves all current and future content, invisible to user. - 3Increase monitoring without changing access: Raise IRM sensitivity, enable real-time DLP block on outbound channels, capture every file touch.
- 4On HR signal — coordinated action: Disable Entra ID account; revoke all sessions; collect endpoint via Defender Live Response; preserve device for forensic imaging. Coordinate with HR for the user notification moment.
C2Evidence Preservation
- 1Forensic image of endpoint: Full disk image + memory capture before any user-facing change. Maintain hash and chain-of-custody documentation.
- 2Mailbox export to PST: Compliance → Content search → Export. Hash the PST on export.
- 3Cloud / repo audit export: SharePoint, OneDrive, GitHub Enterprise audit logs scoped to the user, exported and hashed.
- 4USB serial & file list: Preserve UsbDriveMounted records and the file copy events with timestamps.
04
Eradication
CLEAN UPE1Post-Action Cleanup
- 1Revoke all sessions, tokens, OAuth grants, API keys, SSH keys, app passwords, and personal access tokens issued to the user across every system.
- 2Rotate any shared secrets the user had access to (CI/CD service accounts, Vault tokens, database service principals).
- 3Audit code commits the user pushed in the trailing 90 days for backdoors, leaked secrets, or sabotage. Use
git log --authorwith full diff review. - 4If data is still recoverable (cloud copy, USB recovered from custody), confirm purge with Legal sign-off.
- 5Update IRM policy & tighten DLP rules based on the channel they used — close that channel for the next attempt.
Eradication Complete When
- All credentials and tokens issued to user revoked across all systems
- Forensic image and mailbox PST under chain-of-custody with Legal
- Code & config diff review complete; backdoors / leaked secrets remediated
- Shared secrets the user could access have been rotated
- Policy / DLP rule updated to close the exfil channel
05
Escalation
TIERSESC1Escalation Tiers
| Tier | Trigger | Action / Handoff Bundle |
|---|---|---|
| L1 → L2 | DLP / IRM alert with sensitive data and non-baseline behaviour | User, file list, channel, baseline comparison, related HR signals if known |
| L2 → HR + Legal | Pattern suggests intentional exfiltration; sensitive data confirmed touched | Evidence package (preserved), forensic timeline; await action approval |
| HR/Legal → CISO + Privacy | Customer / regulated data exfil confirmed; reportable breach possible | Disclosure clock assessment, customer notification draft, regulator pre-engagement |
| External | Criminal intent (theft of trade secrets, sabotage, espionage), or value > legal threshold | Law enforcement (FBI IC3 / equivalent), external counsel, civil litigation prep |
Authorized security research & penetration testing only. Unauthorized use is illegal. Authored by Rudra Verma | Senior Security Architect | CyberHawk Threat Intel.