ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: IF016.006
  • Created: 22nd July 2024
  • Updated: 22nd July 2024
  • Contributor: The ITM Team

Creation of Fictitious Invoices

A subject with access to a billing system or indirect access to a billing system misuses their access to create fraudulent invoices, causing payments to be diverted to themselves, a business they own, or a third party.

Prevention

ID Name Description
PV027Financial Approval Process

The financial approval process is a structured procedure used by organizations to review and authorize financial transactions. It includes segregation of duties, authorization levels, and documentation and audit trails to prevent financial abuse and ensure adherence to policies and budgets.

Detection

ID Name Description
DT067Financial Auditing

Financial auditing independently reviews financial records to ensure accuracy and compliance, detecting irregularities and evaluating internal controls. It protects against abuse by identifying fraud and deterring dishonest behavior through increased accountability.

DT068Windows Event Log, Logon and Logoff

By comparing three notable Event IDs, it is possible to build a timeline of when a user account was actively logged into a system. This can help to identify potential periods of inactivity where the account isn't actively being used.

 

Event ID 4624:  A user successfully logged on to a computer.

Event ID 4634:  The logoff process was completed for a user.

Event ID 4647:  A user initiated the logoff process.