PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
INCIDENT TRIAGE · TIER 3
Insider Threat
The threat actor has a badge, a laptop, and legitimate access to everything they're stealing. No exploitation, no malware, no C2. Every action is authorized at the technical level. Detection is entirely behavioral: the right person doing the wrong thing.
reactive or proactive · behavioral baseline required · legal/HR coordination mandatory
The honest answer

There is no signature for insider threat. There is no IOC. There is no YARA rule. The insider uses their own credentials, their own workstation, their own authorized access, during business hours, to access data they are technically permitted to access. The only detection surface is deviation from what they normally do.

That means this playbook is useless without baselines. If you don't know what normal looks like for a given user (what they access, when, how much, from where), you cannot distinguish "working on a project" from "collecting everything before I leave." The investment in user behavior analytics, file access logging, and DLP pays for itself here and nowhere else.

Legal and HR must be involved before you investigate. Insider threat investigations involve monitoring an employee's activity. Depending on your jurisdiction, organization, and the employee's role, this may require legal authorization, HR coordination, union notification, or management approval. Do not begin covert monitoring without legal guidance. Getting this wrong creates liability that outlasts the incident.
Insider threat categories

Malicious insider. Deliberate theft or sabotage. Employee stealing IP before leaving for a competitor, admin planting a logic bomb before termination, or someone selling access to an external actor. The hardest to detect because they know the monitoring and deliberately avoid it.

Negligent insider. No malicious intent, but policy violations that create exposure. Emailing sensitive files to personal accounts for convenience, uploading to unauthorized cloud storage, disabling security controls to make something work, or leaving credentials in public repos. The most common category by volume.

Compromised insider. The employee's credentials are in attacker hands (infostealer, phishing, credential reuse). The "insider" is actually an external actor using a legitimate identity. This overlaps with the Compromised Credentials and Infostealer playbooks. The key differentiator: if the geographic source, timing, and device are consistent with the real user, it might be a true insider, not a compromised account.

Investigation checklist
  1. 1. Establish the user's normal access baseline Pull 60-90 days of the user's activity: file share access (EID 5140/5145), email volume and recipients, application logins, VPN connection patterns, print jobs, USB device connections. Build the profile: what do they normally access, when, how much, from where? Every subsequent step compares current activity against this baseline. Security EID 5140/5145 · DLP logs · Proxy logs · Badge/physical access logs
  2. 2. Look for access outside role or need-to-know Is the user accessing file shares, databases, or applications they don't normally touch? A finance analyst browsing engineering source code repos. A departing sales rep downloading the entire customer database. An IT admin reading executive email. The access may be technically permitted (ACLs don't enforce need-to-know), but the pattern deviation is the indicator. Security EID 5145 · Database access audit · Application-level access logs
  3. 3. Check for bulk data collection Volume anomalies are the strongest signal. Compare the user's current file access volume against their 90-day average. A 10x spike in files accessed, downloaded, or copied is the clearest insider indicator, especially when the spike targets sensitive directories (IP, customer data, financial records, source code). Check for: mass file downloads, archive creation (zip, 7z, tar), and large copy operations. DLP alerts · Security EID 5145 volume analysis · Sysmon EID 11 archive creation
  4. 4. Check for data movement to personal channels Email to personal accounts (Gmail, Yahoo, ProtonMail). Uploads to personal cloud storage (personal OneDrive, Google Drive, Dropbox with a non-corporate login). USB file copies. Printing sensitive documents. AirDrop or Bluetooth transfers. Each of these moves data from corporate-controlled channels to channels the organization cannot monitor or recover from. Email gateway: outbound to freemail domains · DLP: cloud storage uploads · Sysmon EID 11 on removable media
  5. 5. Correlate with HR signals Technical indicators gain weight when combined with HR context. Is the employee on a Performance Improvement Plan? Have they submitted a resignation? Were they passed over for promotion? Is there an ongoing workplace dispute? Have they recently been contacted by a competitor (LinkedIn activity)? None of these alone is evidence. Combined with bulk data access, they build the case.
  6. 6. Check after-hours and off-pattern activity Access during hours the user has never previously worked. VPN connections from locations the user doesn't normally work from. Weekend access when the user is a strict 9-to-5 employee. Badge access to the building at 2 AM. These time-based anomalies are weak signals individually but compound with volume and access pattern deviations. VPN logs · Badge/physical access system · Security EID 4624 timestamp analysis
  7. 7. Check for circumvention of security controls Is the user disabling DLP agents, using unauthorized VPN or proxy services to bypass web filtering, connecting personal devices to the corporate network, or using encrypted personal messaging (Signal, Telegram) for work communications? Circumvention of monitoring is both a policy violation and an indicator that the user knows they're being watched and is actively evading. EDR: agent health · DLP: policy bypass events · Proxy: tunnel/VPN detection
  8. 8. Look for credential or access hoarding Is the user requesting access to systems beyond their role? Creating service accounts or API keys? Saving credentials in personal password managers or plain text files? Copying SSH keys to personal devices? An insider preparing for post-departure access often stages credentials before they leave. Check access request logs and account creation/modification events. HOST: T1552.001 Creds in Files · Security EID 4720 (account creation)
  9. 9. Check for sabotage indicators (privileged users) For IT admins and privileged users: unauthorized changes to backup configurations (disabling backups, modifying retention), creation of hidden admin accounts, deployment of logic bombs (scheduled tasks with future execution dates and destructive payloads), modification of access controls to lock others out, or deletion of audit logs. The admin who knows they're being terminated is the highest-risk insider. HOST: T1485 Data Destruction · HOST: Persistence (scheduled tasks) · T1070.001 Clear Logs
  10. 10. Preserve evidence before any confrontation Before HR takes action (termination meeting, confrontation, PIP conversation): preserve the forensic evidence. Image the user's workstation. Export their email. Snapshot their cloud storage. Pull their complete access logs. Disable their accounts simultaneously with the HR action, not after. An insider who learns they're being investigated will destroy evidence or accelerate exfiltration in the window between discovery and account disablement.
The baseline problem (and what to do about it)

Most organizations don't have user behavior analytics. File access logging is either not enabled or not centralized. DLP is deployed but nobody looks at the alerts. The first insider threat investigation reveals all of this at once and the answer is "we can't tell if this is unusual because we don't know what usual looks like."

Minimum viable baselining for insider threat: Enable and centralize Windows Security EID 5145 (file share access) and EID 4624 (logon events). Enable Exchange/M365 mailbox audit logging. Configure your proxy to log all outbound traffic by user. Enable USB device connection logging. These four sources, aggregated and retained for 90 days, give you enough to answer "is this user doing something they've never done before?" That's not a full UEBA program. It's the floor.

Insider threat vs LOTL: the overlap. Both are "legitimate user, legitimate tools, no malware." The difference is authorization. In LOTL, the credentials belong to the real user but are being wielded by an external attacker. In insider threat, the real user is the actor. The detection signals are nearly identical (baseline deviation, unusual access patterns, data staging). The response differs: LOTL is a credential compromise response, insider threat is a legal/HR/security coordination. The LOTL playbook covers the external-actor scenario.
Timing patterns that matter

Pre-resignation spike. The most common pattern: 2-4 weeks before submitting resignation, the user begins downloading files they've never accessed before. The spike often targets competitive intelligence, customer lists, and source code. By the time HR processes the resignation, the data is already on a personal drive.

Post-PIP escalation. An employee placed on a Performance Improvement Plan who believes termination is inevitable may begin exfiltrating data or preparing sabotage. The PIP notification is the trigger event, and monitoring should increase from that point.

The departing admin. Highest risk, shortest window. An IT admin who knows termination is coming can create backdoor accounts, plant logic bombs, modify backups, and destroy evidence in the time between receiving notice and account disablement. Simultaneous account disablement during the termination meeting is not optional for privileged users.

Nation-state insider operations: FAMOUS CHOLLIMA

There is a fourth insider threat category that didn't exist five years ago: the planted operative. DPRK-linked FAMOUS CHOLLIMA doubled their activity in 2025 (CrowdStrike 2026 GTR), using AI-generated resumes, deepfake video interviews, and fabricated identity documents to place North Korean operatives inside Western companies through legitimate hiring processes. These are not compromised employees. They are intelligence operatives who got hired.

The operatives submit polished resumes generated by LLMs, coach themselves through interviews using hidden devices, and use deepfake or borrowed identities to pass video screening. Once inside, they have legitimate badge access, legitimate credentials, and legitimate need-to-know for their assigned role. Traditional insider threat detection (baseline deviation) doesn't work initially because they ARE establishing their baseline. Detection requires: verifying identity documents through third-party validation, requiring live unscripted video interactions during hiring, and cross-referencing application details against known DPRK front company patterns.

Post-hire containment: attribute-based access controls limiting data scope to defined job functions, audit logging of every data interaction from the first day, and monitoring for behaviors inconsistent with the stated role (accessing systems outside their function, working hours misaligned with their stated timezone, or shipping hardware to unexpected addresses).

Related playbooks

Living-off-the-Land Activity (overlapping detection surface, different root cause)
Compromised Credentials (rule out compromised account before concluding insider threat)
Infostealer Infection (rule out credential theft as the explanation)
Data Exfiltration Detected (the technical investigation of outbound data movement)