performing-insider-threat-investigation

name	performing-insider-threat-investigation
description	Use when investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection. '.
domain	cybersecurity
tags	["insider-threat","user-behavior-analytics","data-exfiltration","privilege-misuse","DFIR"]
subdomain	incident-response
mitre_attack	["T1078","T1048","T1567","T1114"]
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Performing Insider Threat Investigation

Overview

Cybersecurity skill for performing insider threat investigation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing insider threat investigation"

• "Investigates insider threat incidents involving employees, contractors, or trust"

• DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices

• User behavior analytics (UBA) detects anomalous access patterns for a user account

• HR reports a departing employee suspected of taking proprietary information

• A privileged user is observed accessing systems outside their job function

• Whistleblower or coworker report alleges policy violations or data theft

Do not use for external attacker investigations where compromised credentials are used without insider collusion; use standard incident response procedures instead.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Legal counsel approval before initiating any monitoring or investigation of an employee
• HR partnership with defined investigation procedures and employee privacy guidelines
• DLP platform with content inspection and policy enforcement (Symantec DLP, Microsoft Purview, Digital Guardian)
• User behavior analytics platform (Microsoft Sentinel UEBA, Exabeam, Securonix)
• Forensic imaging capability for endpoint examination
• Chain of custody procedures for evidence that may be used in legal proceedings
• Clear authority and scope documentation approved by legal and HR

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}