ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: PR029
  • Created: 15th August 2025
  • Updated: 15th August 2025
  • Contributor: Saksham Tushar

Persistent Access via Bots

The subject exploits their technical role to deploy or manipulate automated bots within the organization’s environment—most commonly within collaboration platforms (e.g., Slack, Teams, Discord) or internal operational systems (e.g., Jira, ServiceNow, Helpdesk tooling). These bots are designed to persist beyond the subject’s tenure, leveraging independent service credentials (or other credentials not specifically associated to a user), webhook integrations, or unattended workflows to maintain covert access.

 

The subject may create new bots under the guise of legitimate productivity enhancements, or hijack existing integrations to expand data access, redirect output, or embed hidden monitoring functionality. Once active, these bots operate continuously, harvesting internal conversations, extracting files, or polling sensitive endpoints—often without triggering standard audit alerts tied to user accounts.

 

Because automation accounts are rarely subject to the same identity governance or offboarding scrutiny as human users, this technique enables long-term persistence, broad data visibility, and operational concealment, facilitating continued access or covert surveillance after the subject’s departure.

Prevention

ID Name Description
PV023Access Reviews

Routine reviews of user accounts and their associated privileges and permissions should be conducted to identify overly-permissive accounts, or accounts that are no longer required to be active.

PV024Employee Off-boarding Process

When an employee leaves the organization, a formal process should be followed to ensure all equipment is returned, and any associated accounts or access is revoked.

PV003Enforce an Acceptable Use Policy

An Acceptable Use Policy (AUP) is a set of rules outlining acceptable and unacceptable uses of an organization's computer systems and network resources. It acts as a deterrent to prevent employees from conducting illegitimate activities by clearly defining expectations, reinforcing legal and ethical standards, establishing accountability, specifying consequences for violations, and promoting education and awareness about security risks.

PV048Privileged Access Management (PAM)

Privileged Access Management (PAM) is a critical security practice designed to control and monitor access to sensitive systems and data. By managing and securing accounts with elevated privileges, PAM helps reduce the risk of insider threats and unauthorized access to critical infrastructure.

 

Key Prevention Measures:


Least Privilege Access: PAM enforces the principle of least privilege by ensuring users only have access to the systems and data necessary for their role, limiting opportunities for misuse.

  • Just-in-Time (JIT) Access: PAM solutions provide temporary, on-demand access to privileged accounts, ensuring users can only access sensitive environments for a defined period, minimizing exposure.
  • Centralized Credential Management: PAM centralizes the management of privileged accounts and credentials, automatically rotating passwords and securely storing sensitive information to prevent unauthorized access.
  • Monitoring and Auditing: PAM solutions continuously monitor and log privileged user activities, providing a detailed audit trail for detecting suspicious behavior and ensuring accountability.
  • Approval Workflows: PAM incorporates approval processes for accessing privileged accounts, ensuring that elevated access is granted only when justified and authorized by relevant stakeholders.

 

Benefits:


PAM enhances security by reducing the attack surface, improving compliance with regulatory standards, and enabling greater control over privileged access. It provides robust protection for critical systems by limiting unnecessary exposure to high-level access, facilitating auditing and accountability, and minimizing opportunities for both insider and external threats.

PV062Static Code Analysis via CI/CD Pipelines

Static code analysis integrated into CI/CD pipelines provides a critical prevention mechanism against anti-forensic behaviors embedded in code, scripts, and infrastructure definitions. By enforcing automated review of logic patterns prior to deployment, organizations can detect concealed execution paths, scheduling abuse, and evasive constructs before they reach production.

 

This control is especially vital in mitigating deferred execution techniques, where the subject inserts code that activates long after submission—typically to evade scrutiny or delay attribution. Static analysis enables defenders to identify high-risk patterns at rest, before runtime, reducing reliance on reactive detection and shortening investigative timelines.

 

Detection of Time-Based Execution Logic:
Flag conditional statements that compare system time or date against hardcoded thresholds or calculated values.
Examples:

  • if (datetime.now() > target_date)
  • if time.time() > 1723468800 (UNIX timestamp obfuscation)

 

Abnormal Delay Functions and Sleep Calls:
Block or escalate the use of delay functions exceeding operational thresholds. Focus on calls intended to stall execution post-deployment.
Examples:

  • sleep(3600)
  • Start-Sleep -Seconds 1800
  • Thread.sleep(900000) (in Java)

 

Embedded Scheduler References in Scripts:
Detect scripting logic that attempts to create or modify scheduled tasks, cron jobs, or background triggers.
Examples:

  • echo '0 4 * * * /usr/bin/script.sh' >> /etc/crontab
  • schtasks /create /tn "Update" /tr C:\temp\payload.exe /sc once /st 23:59
  • at now + 1 minute /interactive "cmd.exe"

 

Identification of Obfuscation and Dynamic Constructs:
Scan for base64-encoded, concatenated, or dynamically constructed commands that attempt to evade static detection of time or scheduling logic.
Examples:

  • eval(base64.b64decode(payload))
  • task_command = "schtasks" + " /create /sc daily"
  • exec("sleep " + str(delay_seconds))

 

CI/CD Blocking and Exception Escalation:
Treat the above patterns as rule violations within CI/CD pipelines. Enforce blocking behavior unless a security-reviewed exception is filed. Ensure exception cases are logged, tagged, and auditable.

 

Pre-Deployment Artifact Scanning:
Apply static analysis not only to source code but to bundled artifacts such as container images, compiled scripts, or deployment templates (e.g., Terraform, CloudFormation) to catch embedded logic in infrastructure as code (IaC).

 

Cross-Team Code Review and Signature Expansion:
Maintain shared detection signatures across DevSecOps, application security, and insider risk teams. Regularly review triggered matches to refine accuracy and discover new anti-forensic variants.

 

Attestation of Safe Logic by Departing Engineers:
Require final code audits for subjects flagged for departure or termination. Mandate re-review of any automation, CI/CD jobs, or privileged scripting authored by the subject.

PV057Structured Request Channels for Operational Needs

Establish and maintain formal, well-communicated pathways for personnel to request resources, report deficiencies, or propose operational improvements. By providing structured mechanisms to meet legitimate needs, organizations reduce the likelihood that subjects will bypass policy controls through opportunistic or unauthorized actions.

 

Implementation Approaches

  • Create clear, accessible request processes for technology needs, system enhancements, and operational support requirements.
  • Ensure personnel understand how to escalate unmet needs when standard processes are insufficient, including rapid escalation pathways for operational environments.
  • Maintain service-level agreements (SLAs) or expected response times to requests, ensuring perceived barriers or delays do not incentivize unofficial action.
  • Integrate feedback mechanisms that allow users to suggest improvements or report resource shortfalls anonymously or through designated representatives.
  • Publicize successful examples where formal channels resulted in legitimate needs being met, reinforcing the effectiveness and trustworthiness of the system.

 

Operational Principles

  • Responsiveness: Requests must be acknowledged and processed promptly to prevent frustration and informal workarounds.
  • Transparency: Personnel should be informed about request status and outcomes to maintain trust in the process.
  • Accountability: Ownership for handling requests must be clearly assigned to responsible teams or individuals.
  • Cultural Integration: Leaders and supervisors should reinforce the use of formal channels and discourage unsanctioned self-remediation efforts.

 

Detection

ID Name Description
DT046Agent Capable of Endpoint Detection and Response

An agent capable of Endpoint Detection and Response (EDR) is a software agent installed on organization endpoints (such as laptops and servers) that (at a minimum) records the Operating System, application, and network activity on an endpoint.

 

Typically EDR operates in an agent/server model, where agents automatically send logs to a server, where the server correlates those logs based on a rule set. This rule set is then used to surface potential security-related events, that can then be analyzed.

 

An EDR agent typically also has some form of remote shell capability, where a user of the EDR platform can gain a remote shell session on a target endpoint, for incident response purposes. An EDR agent will typically have the ability to remotely isolate an endpoint, where all network activity is blocked on the target endpoint (other than the network activity required for the EDR platform to operate).

DT045Agent Capable of User Activity Monitoring

An agent capable of User Activity Monitoring (UAM) is a software agent installed on organization endpoints (such as laptops); typically, User Activity Monitoring agents are only deployed on endpoints where a human user Is expected to conduct the activity.

 

The User Activity Monitoring agent will typically record Operating System, application, and network activity occurring on an endpoint, with a focus on activity that is or can be conducted by a human user. The purpose of this monitoring is to identify undesirable and/or malicious activity being conducted by a human user (in this context, an Insider Threat).

 

Typical User Activity Monitoring platforms operate in an agent/server model where activity logs are sent to a server for automatic correlation against a rule set. This rule set is used to surface activity that may represent Insider Threat related activity such as capturing screenshots, copying data, compressing files or installing risky software.

 

Other platforms providing related functionality are frequently referred to as User Behaviour Analytics (UBA) platforms.

DT047Agent Capable of User Behaviour Analytics

An agent capable of User Behaviour Analytics (UBA) is a software agent installed on organizational endpoints (such as laptops). Typically, User Activity Monitoring agents are only deployed on endpoints where a human user is expected to conduct the activity.

 

The User Behaviour Analytics agent will typically record Operating System, application, and network activity occurring on an endpoint, focusing on activity that is or can be conducted by a human user. Typically, User Behaviour Analytics platforms operate in an agent/server model where activity logs are sent to a server for automatic analysis. In the case of User Behaviour Analytics, this analysis will typically be conducted against a baseline that has previously been established.

 

A User Behaviour Analytic platform will typically conduct a period of ‘baselining’ when the platform is first installed. This baselining period establishes the normal behavior parameters for an organization’s users, which are used to train a Machine Learning (ML) model. This ML model can then be later used to automatically identify activity that is predicted to be an anomaly, which is hoped to surface user behavior that is undesirable, risky, or malicious.

 

Other platforms providing related functionality are frequently referred to as User Activity Monitoring (UAM) platforms.

DT112Asset Discovery Audit

A scheduled, systematic audit of organizational assets to verify that all hardware, software, and network infrastructure aligns with approved inventories and configuration baselines. The audit is designed to detect unauthorized, unapproved, or misconfigured assets that may have been introduced opportunistically by subjects circumventing standard processes.

 

Detection Methods

  • Conduct periodic formal asset discovery audits using network scanning tools, endpoint management platforms, and manual verification processes.
  • Reconcile discovered assets against authoritative asset management databases (e.g., CMDB, inventory systems).
  • Inspect critical operational areas physically to identify unauthorized devices such as rogue wireless access points, unsanctioned satellite terminals, or personally procured IT hardware.
  • Require supporting documentation (e.g., procurement records, change approvals) for all assets found during audits.
  • Audit virtual infrastructure and cloud accounts to detect unapproved services, instances, or network configurations introduced outside formal governance.

 

Indicators

  • Assets detected during the audit that are absent from official asset registries.
  • Devices operating without appropriate configuration management, endpoint security tooling, or monitoring integration.
  • Physical or virtual infrastructure deployed without associated change control, procurement, or authorization records.
  • Wireless networks or external connections operating without approved designations or safeguards.
DT052Audit Logging

Audit Logs are records generated by systems and applications to document activities and changes within an environment. They provide an account of events, including user actions, system modifications, and access patterns.

DT111Cyber Deception, Honey SPN

Service Principal Names (SPNs) are unique identifiers used by the Kerberos authentication protocol to associate a service instance with a specific account in Active Directory. In the Kerberos authentication process, a client—which could be any user, computer, or service—requests access to a particular service, such as email, file shares, or database servers. To authenticate and gain access to that service, the client must obtain a service ticket from the Ticket Granting Service (TGS).

 

The client first requests a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC), which is part of the Kerberos infrastructure. Once the client has a TGT, it can use it to request a service ticket from the TGS for a specific service identified by its SPN. The service ticket contains the hashed credentials of the service account associated with that SPN, allowing the client to authenticate to the service securely.

In a Kerberoasting attack, an adversary—who is often a domain-joined user—requests service tickets for service accounts with weak or guessable passwords. These tickets can then be captured and cracked offline to reveal the service account’s password. This process is typically initiated by an attacker who targets SPNs associated with high-privilege accounts.

 

A Honey SPN is a decoy SPN created with no legitimate use, designed specifically to attract malicious actors. By monitoring for TGS requests for these fake SPNs, defenders can detect when attackers are probing for service tickets associated with non-existent or intentionally misleading accounts. These unauthorized requests serve as an early detection mechanism, allowing defenders to identify enumeration attempts and potential attack activities before credential abuse occurs.

 

Event ID: 4769 – Kerberos Service Ticket Request (Security Log)
This event is logged whenever a client requests a service ticket from the TGS. It provides details of the SPN being requested, allowing defenders to track requests for honey SPNs and identify potential Kerberoasting activity.

DT048Data Loss Prevention Solution

A Data Loss Prevention (DLP) solution refers to policies, technologies, and controls that prevent the accidental and/or deliberate loss, misuse, or theft of data by members of an organization. Typically, DLP technology would take the form of a software agent installed on organization endpoints (such as laptops and servers).

 

Typical DLP technology will alert on the potential loss of data, or activity which might indicate the potential for data loss. A DLP technology may also provide automated responses to prevent data loss on a device.

DT104Leaver Watchlist

In relevant security tooling (such as a SIEM or EDR), a watchlist (also known as a reference set) should be used to monitor for any activity generated by accounts belonging to employees who have left the organization, as this is unexpected. This can help to ensure that the security team readily detects any unrevoked access or account usage.

 

This process must be in partnership with the Human Resources team, which should inform the security team when an individual leaves the organization (during an Employee Off-Boarding Process, see PV024), including their full and user account names. Ideally, this process should be automated to prevent any gaps in monitoring between the information being sent and the security team adding the name(s) to the watchlist. All format variations should be considered as individual entries in the watchlist to ensure accounts using different naming conventions will generate alerts, such as john.smith, john smith, john.smith@company.com, and jsmith.

 

False positives could occur if there is a legitimate reason for interaction with the account(s), such as actions conducted by IT staff.

DT113Tracking Patterns of Policy Violations

Monitor and analyze minor policy violations over time to detect emerging behavioral patterns that may indicate boundary testing, behavioural drift, or preparation for more serious misconduct. Isolated minor infringements may appear benign, but repeated or clustered incidents can signal a developing threat trajectory.

 

Detection Methods

  • Maintain centralized logging of all recorded policy violations, including low-severity infractions, within case management, HR, or security systems.
  • Implement analytical tools or workflows that flag individuals with multiple minor violations within defined timeframes (e.g., repeated unauthorized device use, bypassing security protocols, small unauthorized disclosures).
  • Correlate minor violation data with other risk indicators such as unauthorized access attempts, changes in behavioral baselines, or indicators of disgruntlement.
  • Analyze patterns across teams, units, or operational areas to detect systemic issues or cultural tolerance of rule-breaking behaviors.
  • Conduct periodic behavioral risk reviews that explicitly include minor infractions as part of insider threat monitoring programs.
  •  

Indicators

  • Subjects accumulating multiple low-level infractions without corresponding corrective action or behavioral improvement.
  • Increased frequency or severity of minor violations over time, suggesting desensitization or emboldenment.
  • Violations spanning multiple domains (e.g., IT security, operational protocols, HR policy), indicating generalized disregard for rules.
  • Evidence that minor violations are clustered around operational pressures, major organizational changes, or periods of reduced oversight.
DT102User and Entity Behavior Analytics (UEBA)

Deploy User and Entity Behavior Analytics (UEBA) solutions designed for cloud environments to monitor and analyze the behavior of users, applications, network devices, servers, and other non-human resources. UEBA systems track normal behavior patterns and detect anomalies that could indicate potential insider events. For instance, they can identify when a user or entity is downloading unusually large volumes of data, accessing an excessive number of resources, or engaging in data transfers that deviate from their usual behavior.

DT101User Behavior Analytics (UBA)

Implement User Behavior Analytics (UBA) tools to continuously monitor and analyze user (human) activities, detecting anomalies that may signal security risks. UBA can track and flag unusual behavior, such as excessive data downloads, accessing a higher-than-usual number of resources, or large-scale transfers inconsistent with a user’s typical patterns. UBA can also provide real-time alerts when users engage in behavior that deviates from established baselines, such as accessing sensitive data during off-hours or from unfamiliar locations. By identifying such anomalies, UBA enhances the detection of insider events.