Infringement
Disruption of Business Operations
Excessive Personal Use
Exfiltration via Email
Exfiltration via Media Capture
Exfiltration via Messaging Applications
Exfiltration via Other Network Medium
Exfiltration via Physical Medium
- Exfiltration via Bring Your Own Device (BYOD)
- Exfiltration via Disk Media
- Exfiltration via Floppy Disk
- Exfiltration via New Internal Drive
- Exfiltration via Physical Access to System Drive
- Exfiltration via Physical Documents
- Exfiltration via Target Disk Mode
- Exfiltration via USB Mass Storage Device
- Exfiltration via USB to Mobile Device
- Exfiltration via USB to USB Data Transfer
Exfiltration via Web Service
Inappropriate Web Browsing
Installing Unapproved Software
Misappropriation of Funds
Non-Corporate Device
Providing Access to a Unauthorized Third Party
Public Statements Resulting in Brand Damage
Sharing on AI Chatbot Platforms
Theft
Unauthorized Changes to IT Systems
Unauthorized Printing of Documents
Unauthorized VPN Client
Unlawfully Accessing Copyrighted Material
- ID: IF016.006
- Created: 22nd July 2024
- Updated: 22nd July 2024
- Contributor: The ITM Team
Creation of Fictitious Invoices
A subject with access to a billing system or indirect access to a billing system misuses their access to create fraudulent invoices, causing payments to be diverted to themselves, a business they own, or a third party.
Prevention
| ID | Name | Description |
|---|---|---|
| PV027 | Financial Approval Process | The financial approval process is a structured procedure used by organizations to review and authorize financial transactions. It includes segregation of duties, authorization levels, and documentation and audit trails to prevent financial abuse and ensure adherence to policies and budgets. |
Detection
| ID | Name | Description |
|---|---|---|
| DT067 | Financial Auditing | Financial auditing independently reviews financial records to ensure accuracy and compliance, detecting irregularities and evaluating internal controls. It protects against abuse by identifying fraud and deterring dishonest behavior through increased accountability. |
| DT068 | Windows Event Log, Logon and Logoff | By comparing three notable Event IDs, it is possible to build a timeline of when a user account was actively logged into a system. This can help to identify potential periods of inactivity where the account isn't actively being used.
Event ID 4624: A user successfully logged on to a computer. Event ID 4634: The logoff process was completed for a user. Event ID 4647: A user initiated the logoff process. |