Email Gateway

A subject uses electronic mail to exfiltrate data. This can be achieved through including data in the email subject line or body, or utilizing email attachments to send files.

A subject deceptively manipulates and/or persuades others in order to gain access to devices, systems or services that hold sensitive information, or to otherwise cause harm or undermine a target organization.

A subject is motivated by political, philosophical, religious, social, or other ideological beliefs to engage in an infringement against an organization. Such infringements may include unauthorized access, data exfiltration, destruction of information, sabotage, or violations of organizational policy undertaken to advance, defend, or draw attention to a particular cause or belief system.

Ideological motivation arises when a subject's beliefs influence their decision to act against the interests or established rules of an organization. The subject may perceive their actions as morally justified, necessary, or consistent with a broader political, philosophical, or social objective, even where those actions result in organizational harm.

During an investigation, ideological motivation should be established through evidence linking the subject's expressed objectives or beliefs to the infringement. The possession or expression of ideological beliefs alone does not establish malicious intent or constitute evidence of an insider threat.

A subject falsely or improperly represents that they possess authority to speak, decide, approve, negotiate, instruct, certify, or make commitments on behalf of the organization. The subject uses their genuine association with the organization, their role, access to internal communication channels, or knowledge of organizational processes to make the representation appear legitimate.

Unauthorized Organizational Representation may occur through email, collaboration platforms, telephone calls, meetings, social media, customer communications, supplier negotiations, contractual discussions, regulatory engagement, public statements, or internal directives. The subject may claim authority they do not hold, act outside the limits of delegated authority, or omit information that would make the lack of authorization apparent.

The behavior may result in unauthorized commitments, misleading statements, improper instructions, reputational harm, financial liability, disclosure of protected information, disruption of established decision-making, or reliance by an internal or external party. A representation may be harmful even where the subject does not obtain access or impersonate another named individual.

This object differs from PR027 – Impersonation. Impersonation concerns adopting, fabricating, or misrepresenting identity to enable access or another planned action. Unauthorized Organizational Representation concerns misuse of actual or apparent institutional authority. Both objects may apply where the subject assumes another person’s identity and then issues instructions or commitments on behalf of the organization.

Investigators should examine delegated-authority records, approval requirements, communication history, signature blocks, meeting records, contractual limits, and whether recipients reasonably relied upon the representation.

A subject deliberately develops a relationship of trust with a colleague, administrator, service provider, customer, or control owner to obtain future assistance, information, approval, or reduced scrutiny.

The conduct may involve repeatedly offering help, volunteering for tasks, creating dependency, demonstrating apparent reliability, or establishing informal communication outside approved processes. The relationship is later used to secure exceptional access, accelerate a request, obtain confidential information, bypass verification, or discourage challenge.

This would not classify ordinary professional relationship-building. Investigative relevance arises where the relationship is developed or exploited to enable a subsequent infringement.

A subject deliberately uses a decision-making authority granted through their organizational role to approve, deny, waive, prioritize, suppress, or otherwise determine an outcome for an unauthorized purpose.

The subject may be technically and procedurally entitled to make the decision. The infringement arises because the authority is exercised contrary to the organization’s interests, applicable policy, delegated limits, or the legitimate purpose for which the authority was granted.

This behavior may be difficult to identify through conventional access-control monitoring because the subject acts through authorized workflows and assigned permissions. Investigation requires examination of the decision, its stated justification, the subject’s relationship to affected parties, applicable policy requirements, and comparable decisions made under similar circumstances.

This is narrower than general “authority abuse.” It focuses on the improper exercise of an entrusted decision right.

A subject actively seeks opportunities to participate in an infringement on behalf of an external party by advertising, offering, or communicating their willingness to misuse organizational access, information, or position of trust. This may involve posting on underground forums, responding to recruitment advertisements, or approaching individuals through social media, messaging platforms, or other communication channels.

The subject may disclose their employment position, access privileges, or potential capabilities to attract interested parties, negotiate compensation, or establish arrangements for subsequent unauthorized activity.

A subject exfiltrates organizational information using a corporate-issued email account, either through an installed email application or webmail. The information may be transmitted to an external recipient or retained within the mailbox for subsequent unauthorized retrieval.

A subject exfiltrates organizational information using a personal email account or another mailbox accessible to them, either through an installed email application or webmail. The information may be transmitted to an external recipient or retained within the mailbox for subsequent unauthorized retrieval.

The subject creates an email forwarding rule to transport any incoming emails from one mailbox to another.

The subject acts under coercion stemming from threats that target reputation, professional standing, financial stability, or exposure of personal secrets. These threats may be digitally delivered. While these actions stop short of threatening physical harm, they can exert intense psychological pressure, particularly when the subject believes their career, relationships, or public image are at imminent risk.

This type of coercion may originate from:

• Former colleagues, romantic partners, or adversarial insiders with access to sensitive personal or professional material.
  Political actors, who have a political agenda against the subject's work place.
• External criminal actors (or hacktivist groups) who have compromised a personal account or acquired compromising data (e.g., via credential leaks or private messages).

Unlike ideological motivation or personal gain, this behavior is driven by fear of exposure or ruin, not alignment with the threat actor’s objectives. Subjects may act reluctantly, leave minimal technical traces of coordination, and revert to baseline behavior once the coercive force is removed.

A third party uses deception or manipulation to influence a subject into disclosing organizational information, providing unauthorized access to devices or systems, or undertaking other actions that harm or undermine the organization. The subject may be unaware of the third party's intentions or the potential consequences of their actions.

The subject intentionally weakens or bypasses network security controls for a third party, such as providing credentials or disabling security controls.

The subject deliberately deletes emails - either sent, received, or both - with the intent to obstruct investigative visibility, remove evidence of policy violations, or eliminate traces of communication relevant to an insider event. While routine inbox maintenance is common, patterns of targeted deletion may indicate purposeful concealment.

The subject retrieves files from email systems, typically via attachments or embedded download links within corporate or personal email accounts. This includes access through thick clients (e.g., Outlook) or webmail interfaces.

Email-based file retrieval is a common and low-friction method for introducing external content into the environment. Attachments may originate from external senders, personal accounts, or previously staged communications.

A subject intentionally alters the filename, file extension, metadata tags, document properties, or visible descriptive attributes of sensitive organizational data to make it appear to be benign personal information. This may include disguising proprietary, regulated, technical, financial, customer, or strategic material as photographs, household records, recipes, receipts, travel documents, music files, temporary files, or other low-risk personal content.

This technique is typically performed before data staging, transfer, or exfiltration. It may reduce scrutiny during manual review, mislead investigators during triage, or weaken controls that rely on filename, extension, path, metadata, or user-applied classification fields. Investigators should assess this behavior in proximity to file access, bulk download, archive creation, removable media use, cloud upload, email transmission, or other indicators of planned data loss.

A common scenario occurs during offboarding, where a subject is permitted to remove or transfer legitimate personal files from a corporate device before returning the asset. The subject may exploit this authorized window by disguising sensitive organizational data as personal material, relying on the expectation that files labeled as photographs, tax records, household documents, or other personal content will receive less scrutiny. This behavior can create ambiguity for investigators because the initial transfer context may appear procedurally authorized, while the concealed content indicates preparation for later exfiltration or unauthorized retention.

Examples of Use

• A subject renames 2026_Product_Roadmap.xlsx to holiday_budget.xlsx before copying it to removable media.
• A subject changes customer_export.csv to family_photos.tmp and stores it in a personal folder prior to upload.
• A subject modifies document properties, author fields, tags, or comments to remove project, client, or classification references.
• A subject applies misleading metadata such as “personal,” “recipe,” “tax,” “school,” or “photos” to files containing proprietary information.
• A subject changes an engineering design file extension to appear as a media, text, or backup file before moving it into a staged directory.

A subject uses email to deceive, manipulate, or persuade another person into disclosing information, performing an action, approving a request, or enabling access that may support a later infringement. The subject may send messages from a corporate mailbox, personal account, spoofed address, compromised account, or third-party service in order to create a convincing pretext.

This behavior may involve impersonating a colleague, manager, vendor, customer, service provider, or trusted authority. The subject may use urgency, confidentiality, procedural familiarity, or organizational context to influence the recipient’s decision-making. The intended outcome may include obtaining credentials, internal process information, sensitive documents, access approvals, financial changes, or other information or actions that prepare the subject for further misuse.

A subject uses voice communication to deceive, pressure, or persuade another person into disclosing information, changing a control, approving access, or taking an action that may support a later infringement. This may occur through corporate telephony, mobile calls, voice over IP services, conference platforms, helpdesk calls, or external calling infrastructure.

This behavior may involve impersonation, false authority, urgency, familiarity, or procedural manipulation. The subject may contact service desk personnel, administrators, reception staff, colleagues, vendors, or other individuals who can influence access, identity verification, physical entry, operational processes, or administrative controls. The intended outcome may include account recovery, password reset assistance, disclosure of internal procedures, access approval, security exception handling, or other enabling action.

A subject redirects organizational equipment, vehicles, facilities, laboratories, production capability, or other physical assets toward an unauthorized use. Harm may include reduced availability, damage, operating cost, or disruption to legitimate activity.

A subject uses delegated authority to approve a request, transaction, entitlement, exception, appointment, payment, access grant, or other organizational action without a legitimate basis.

Examples include:

• approving access for a favored individual without business justification
• approving a supplier despite an undisclosed conflict
• authorizing expenditure outside the intended purpose
• approving an exception using false or incomplete supporting information

The defining evidence is an affirmative decision made through authority legitimately assigned to the subject.

A subject uses organizational authority to deny another person a service, benefit, request, opportunity, access right, payment, review, or other outcome without a legitimate organizational basis.

Examples include:

• denying a legitimate customer request because of a personal dispute
• refusing an employee entitlement in retaliation
• blocking a supplier or applicant to benefit an associate
• rejecting an access request despite established eligibility
• withholding an approval to exert pressure on another individual

A subject uses decision-making authority to provide an unauthorized advantage to a person, organization, account, supplier, applicant, or other beneficiary.

Examples include:

• prioritizing an associate’s application outside established criteria
• granting favorable commercial terms without authorization
• selecting a supplier because of an undisclosed personal relationship
• allocating a scarce benefit contrary to the approved process
• overlooking a requirement for a favored party while enforcing it against others

A subject uses their authority to prevent, terminate, delay, redirect, or improperly narrow a required organizational review, escalation, complaint, referral, or investigation.

Examples include:

• preventing a security concern from being referred to the appropriate team
• closing a complaint without the required review
• declining to escalate a report involving an associate
• directing that an audit finding not be formally recorded
• narrowing an investigation to exclude relevant conduct or evidence

A subject improperly waives, bypasses, suspends, or grants an exception to a mandatory organizational control using authority available through their role.

Examples include:

• waiving identity-verification requirements
• exempting a transaction from secondary review
• overriding a mandatory security or compliance check
• allowing work to proceed despite an unmet control condition
• approving an exception without recording the required rationale

A subject uses decision-making authority to improperly accelerate, delay, elevate, or deprioritize a request, case, transaction, task, customer, or other item within an organizational process.

Examples include:

• moving an associate’s request ahead of others without justification
• deliberately delaying a complaint until a deadline expires
• deprioritizing a customer because of a personal disagreement
• changing case urgency to avoid scrutiny or service obligations
• accelerating a transaction so that required review cannot occur

A subject conducts a limited transfer of non-sensitive or low-value data to determine whether organizational controls detect, block, quarantine, or escalate the activity.

The subject may send a file to a personal email account, upload content to an unapproved cloud storage service, transfer data through a messaging platform, or use another external destination before attempting a larger or more sensitive transfer. They may vary the file type, size, classification, destination, compression, encryption, or transfer method to identify which conditions trigger Data Loss Prevention (DLP), web proxy, email gateway, or cloud access security controls.

The behavior may include a pause after the test while the subject waits to determine whether security personnel, management, or another authority responds. A successful test may establish a viable exfiltration route or reveal thresholds that can be avoided during a later infringement.

A subject seeks to recruit a person outside the affected organization’s current or former authorized-access population to knowingly assist an infringement or its concealment. The requested assistance may involve identifying or acting as a buyer for organizational information, arranging unauthorized transactions, supplying technical capabilities, providing infrastructure, introducing further participants, or receiving and handling information, assets, or proceeds. The subject may approach an existing personal or professional contact, seek an introduction through an intermediary, or contact a previously unknown person.

The distinguishing feature is the recruitment of external participation in the unauthorized activity, rather than ordinary engagement with an external service provider or information recipient. Investigators should establish the role proposed, the improper purpose communicated, the person’s response, and any agreed terms or subsequent assistance. A person who unknowingly provides an otherwise legitimate service should not be classified as a recruited collaborator. Contact with an external party, an introduction, or an unexplained payment does not independently establish recruitment.

A subject proactively advertises or offers their willingness to misuse organizational access, information, resources, or position of trust to facilitate an infringement on behalf of a third party. This may involve publishing offers on underground forums, posting on social media, or directly approaching external individuals or groups seeking opportunities for unauthorized activity.

The subject may disclose details of their organizational affiliation, access privileges, technical capabilities, or the types of information and systems available to them to attract interested parties. Such activity may involve soliciting financial compensation, proposing arrangements for collaboration, or offering access to organizational resources in exchange for other benefits.

The defining characteristic is that the subject initiates the solicitation, positioning themselves as a potential participant in an infringement before any formal agreement or unauthorized activity has occurred.

A subject knowingly responds to recruitment advertisements, solicitations, or offers from third parties seeking individuals willing to misuse their organizational access, information, resources, or position of trust to facilitate an infringement. These opportunities may be encountered on underground forums, social media platforms, messaging services, or through direct communications from external individuals.

The subject may initiate contact with the recruiting party, express interest in participating, disclose their organizational affiliation or access capabilities, or discuss potential activities, compensation, and conditions of involvement. Engagement may progress from an initial expression of interest to more detailed discussions concerning the subject's ability to facilitate unauthorized access, information disclosure, sabotage, or other infringements.

The defining characteristic is the subject's voluntary engagement with an existing recruitment opportunity, rather than independently advertising their services. The behavior may constitute preparatory activity even where no agreement is reached or subsequent infringement occurs.