AV-05 · Insider threat and privilege misuse

Insider threats include malicious insiders, negligent users, and over-privileged staff or contractors whose access can be misused intentionally or accidentally to expose systems, data, or operations.

$ action: Enforce least privilege, strong monitoring for sensitive actions, separation of duties, and fast access review / revocation workflows.

1. Why Insider Threat Exists

Insider threat exists because organizations must grant real people and third parties access to systems, data, and operational workflows. That necessary trust creates risk when access is excessive, unmanaged, or used outside approved purposes.

Not all insider incidents are malicious. Many damaging events come from negligence, rushed operations, policy bypasses, or poor understanding of data handling and administrative impact. Defenders should design controls for both malicious and accidental misuse.

Insider threat is hard because normal activity can look similar to harmful activity. The key difference is context: role, timing, scope, destination, change history, and whether the action matches legitimate business need.

2. What Insiders Can Do (and Why It Is High Impact)

Insiders or compromised privileged accounts can copy sensitive data, disable logs, alter firewall or identity settings, create hidden accounts, approve risky changes, or bypass normal change controls. They may also provide indirect access to external attackers through weak remote workflows.

The impact is often higher than commodity attacks because insiders may already know where critical systems live, which controls are weak, and which actions are least likely to trigger immediate attention.

In practice, many insider scenarios are privilege misuse scenarios. Over-broad access, shared admin accounts, and weak auditing create the conditions where one bad decision can affect many systems quickly.

3. How Defenders Reduce Insider Risk Without Breaking Operations

Start with access design: least privilege, role-based access, separate admin accounts, approval workflows for high-risk actions, and periodic access reviews. It is easier to monitor and justify activity when privileges reflect real job duties.

Log and review sensitive actions, not just sign-ins. Focus on account creation, policy changes, firewall rule changes, data exports, privilege grants, disabling controls, and unusual access to admin systems.

Build a fair, evidence-based triage process. Insider investigations require careful handling, strong documentation, and coordination with leadership/HR/legal based on policy and jurisdiction. Avoid jumping to conclusions on a single alert.

detection-signals

$Privileged actions outside normal hours or from unusual devices/locations.
$Bulk data access, export, or compression activity that deviates from role baseline.
$Changes to logging, security tooling, firewall rules, or access policies without approved change records.
$Use of shared/admin accounts outside normal scope or by unexpected users.
$Repeated access to sensitive resources shortly before resignation, termination, or role change (context-dependent and policy-governed).

telemetry-sources

$Identity provider and privileged access logs (admin actions, role changes, MFA events).
$Windows/Linux admin logs, audit logs, and file access logs on sensitive systems.
$Firewall, VPN, proxy, and DLP logs for unusual data movement and destination patterns.
$Change management/ticketing systems to confirm whether risky actions were approved.
$EDR/XDR or host telemetry for archival tools, unusual copy operations, and script activity.

recommended-tools-and-guides

open Wazuh Correlate host and security events to track privileged actions and tampering attempts. open Sigma Create detections for admin misuse patterns and suspicious control changes. open Zeek Observe unusual internal data transfers and protocol behavior tied to sensitive hosts. open Security Onion Use integrated visibility and case workflows for insider-risk investigations. open /learning/linux-windows-logging-basics-for-defenders Build the host logging foundations required for sensitive-action monitoring.

lab-safe-detection-workflows

These commands are for learning, validation, and defensive triage in your own lab or authorized environment. Adapt to your tooling and log locations.

Sensitive action log review (host + auth context)

journalctl --since "-24h" | grep -Ei "sudo|useradd|usermod|passwd|firewall|audit|disable|policy" | tail -n 120
grep -Ei "sudo|session opened|session closed|FAILED|Accepted" /var/log/auth.log | tail -n 120 || true
printf "time,account,host,action,approved_change,evidence,next_step\n" > insider-triage.csv

$ why: Build a documented timeline before escalation. Insider-related triage requires evidence discipline and context about approvals/change windows.

Internal data movement baseline check (authorized NSM review)

zeek -r internal-file-access.pcap local
zeek-cut ts id.orig_h id.resp_h service orig_bytes resp_bytes < conn.log | head -n 50
tshark -r internal-file-access.pcap -z io,stat,60 -q

$ why: Use NSM and packet evidence to compare data movement volume and paths against expected operational behavior.

triage-questions

?Was the action expected for the user's role, shift, and approved work?
?Is there a valid change ticket or business justification for the privileged action?
?What specific data, systems, or controls were touched, and what was the impact?
?Does the activity pattern indicate negligence, compromised credentials, or intentional misuse?
?What immediate containment step is appropriate and proportionate (session revoke, temporary access suspension, increased monitoring)?

defender-actions.checklist

$Enforce least privilege and separate admin accounts.
$Review and re-certify access regularly (especially privileged and third-party accounts).
$Log and alert on high-risk administrative and policy-changing actions.
$Correlate sensitive actions with change approvals and ticketing records.
$Prepare an insider-risk response process with evidence handling and cross-team coordination.

study-workflow

Learn what normal behavior looks like for this area (auth, exposure, config, or internal traffic).
Identify the logs and telemetry that should show the behavior.
Practice one safe validation in a lab or authorized environment.
Write a short playbook for detection, triage, and response.
Review the related tool guides under /learning/tools.

<- previous threat AV-04 · Lateral movement after initial access -> next threat AV-06 · State-backed and foreign targeted intrusions