ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: IF008
  • Created: 31st May 2024
  • Updated: 05th July 2024
  • Platforms: Windows, Linux, MacOS
  • Contributor: The ITM Team

Inappropriate Web Browsing

A subject accesses web content that is deemed inappropriate by the organization.

Subsections

ID Name Description
IF008.004Extremist Content

A person accesses, possesses, or distributes materials that advocate, promote, or incite extreme ideological, political, or religious views, often encouraging violence or promoting prejudice against individuals or groups.

IF008.005Gambling

A subject accesses or participates in online gambling from a corporate device, contravening internal policies on acceptable use of company equipment.

IF008.007Gaming

A subject accesses or participates in web-based online gaming from a corporate device, contravening internal policies on acceptable use of company equipment.

IF008.006Inappropriate Usage of Social Media

A subject misuses social media platforms to engage in activities that violate organizational policies, compromise security, disclose confidential information, or damage the organization’s reputation. This includes sharing sensitive data, making unauthorized statements, engaging in harassment or bullying, or undertaking any actions that could risk the organization’s digital security or public image.

IF008.001Lawful Pornography

A subject accesses lawful pornographic material from an organization device, contravening internal policies on acceptable use of organization equipment.

IF008.008Other Inappropriate Content

A subject accesses other inappropriate web content from a corporate device, contravening internal policies on acceptable use of company equipment.

IF008.003Terrorist Content

A subject accesses, possesses and/or distributes materials that advocate, promote, or incite unlawful acts of violence intended to further political, ideological or religious aims (terrorism).

IF008.002Unlawful Pornography

A subject accesses unlawful pornographic material from a organization device, contravening internal policies on acceptable use of organization equipment and potentially, the law.

Prevention

ID Name Description
PV021DNS Filtering

Domain Name System (DNS) filtering allows the blocking of domain resolution for specific domains or automatically categorized classes of domains (depending on the functionality of the software or appliance being used). DNS filtering prevents users from accessing blocked domains, regardless of the IP address the domains resolve to.

 

Examples of automatically categorized classes of domains are ‘gambling’ or ‘social networking’ domains. Automatic categorizations of domains are typically conducted by the software or appliance being used, whereas specific domains can be blocked manually. Most DNS filtering software or appliances will provide the ability to use Regular Expressions (RegEx) to (for example) also filter all subdomains on a specified domain.

DNS filtering can be applied on an individual host, such as with the hosts file, or for multiple hosts via a DNS server or firewall.

PV003Enforce an Acceptable Use Policy

An Acceptable Use Policy (AUP) is a set of rules outlining acceptable and unacceptable uses of an organization's computer systems and network resources. It acts as a deterrent to prevent employees from conducting illegitimate activities by clearly defining expectations, reinforcing legal and ethical standards, establishing accountability, specifying consequences for violations, and promoting education and awareness about security risks.

PV006Install a Web Proxy Solution

A web proxy can allow for specific web resources to be blocked, preventing clients from successfully connecting to them.

Detection

ID Name Description
DT059Chrome Browser Bookmarks

Google's Chrome browser stores the history of accessed websites and files downloaded.

 

On Windows, this information is stored in the following location: C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Login Data. This file is a JSON file and can be opened in any text editor, such as Notepad. This contains the URL, page title, date added, and date the bookmark was last used.

DT057Chrome Browser Cookies

Google's Chrome browser stores cookies that can reveal valuable insights into user behavior, including login details, session durations, and frequently visited sites.

 

On Windows, this information is stored in the following location:

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Network\cookies.

 

This database file can be opened in software such as DB Browser For SQLite. The ‘cookies' table is of interest to understand recent activity within Chrome.

DT060Chrome Browser Extensions

Google's Chrome browser stores details about any browser extensions that are installed, providing the user with additional functionality.

 

On Windows, this information is stored in the following location: C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Extensions. Several directories will be listed, each one representing an installed extension. The directories and files inside, notably 'manifest.json', will contain information about the extension and its functionality. This can be combined with OSINT to learn more about the extension.

DT019Chrome Browser History

Google's Chrome browser stores the history of accessed websites and files downloaded.

 

On Windows, this information is stored in the following location:

C:/Users/<Username>/AppData/Local/Google/Chrome/User Data/Default/

On macOS:

/Users/<Username>/Library/Application Support/Google/Chrome/Default/

On Linux:

/home/<Username>/.config/google-chrome/Default/

 

Where /Default/ is referenced in the paths above, this is the default profile for Chrome, and can be replaced if a custom profile is used. In this location one database file is relevant, history.sqlite.
 

This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome.

DT058Chrome Browser Login Data

Google's Chrome browser stores some login data of accessed websites, that can provide the URLs and usernames used for authentication.

 

On Windows, this information is stored in the following location:

C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Login Data.

 

This file is a database file and can be opened in software such as DB Browser For SQLite. The ‘logins’ and ‘stats’ tables are of immediate interest to understand saved login data.

 

The passwords are not visible as they are encrypted. However, the encryption key is stored locally and can be used to decrypt saved passwords. The key is stored in the file C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Local State, which can be read with any text editor, such as Notepad, and searching for the “encrypted_key” value. The tool decrypt_chrome_password.py (referenced) can decrypt the AES-encrypted passwords to plaintext.

DT018Edge Browser History

Microsoft's Edge browser stores the history of accessed websites and files downloaded.

 

On Windows, this information is stored in the following location:

C:\Users\<Username>\AppData\Local\Microsoft\Edge\User Data\Default\

On macOS:

/Users/<Username>/Library/Application Support/Microsoft Edge/Default/

On Linux:

/home/<Username>/.config/microsoft-edge/Default/

 

Where /Default/ is referenced in the paths above, this is the default profile for Edge, and can be replaced if a custom profile is used. In this location one database file is relevant, history.sqlite.
 

This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome.

DT017Firefox Browser History

Mozilla's Firefox browser stores the history of accessed websites.

 

On Windows, this information is stored in the following location:

C:\Users\<Username>\AppData\Roaming\Mozilla\Firefox\Profiles\<Profile Name>\

On macOS:

/Users/<Username>/Library/Application Support/Firefox/Profiles/<Profile Name>/

On Linux:

/home/<Username>/.mozilla/firefox/<Profile Name>/

 

In this location two database files are relevant, places.sqlite (browser history and bookmarks) and favicons.sqlite (favicons for visited websites and bookmarks).
 

These database files can be opened in software such as DB Browser For SQLite.

DT039Web Proxy Logs

Depending on the solution used, web proxies can provide a wealth of information about web-based activity. This can include the IP address of the system making the web request, the URL requested, the response code, and timestamps.

An organization must perform SSL/TLS interception to receive the most complete information about these connections.