<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-unauthorized-data-access
description: >-
  Detect unauthorized access to sensitive data through log analysis, behavioral
  analytics, access pattern anomalies, and privilege abuse detection across
  databases, file shares, cloud storage, and application data stores.
domain: cybersecurity
subdomain: data-security
tags:
  - unauthorized-access
  - insider-threat
  - ueba
  - access-monitoring
  - privilege-abuse
  - anomaly-detection
  - siem
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Detecting Unauthorized Data Access

## Overview

Unauthorized data access occurs when users, service accounts, or compromised
credentials access data beyond their legitimate need. Detection requires
baselining normal access patterns and identifying deviations — off-hours access,
unusual query volumes, access to data outside normal scope, and privilege
escalation. This skill covers access log analysis, behavioral anomaly detection,
and UEBA-style pattern recognition.

Mode: `[MODE: BLUE]` — Access monitoring and insider threat detection.

## Prerequisites

- Access logs from databases, file shares, and cloud storage
- Authentication logs (Active Directory, IdP, SSO)
- Baseline of normal access patterns per user/role
- SIEM with user entity correlation

## Key Concepts

### Unauthorized Access Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| Off-hours access | Data access outside normal working hours | Medium |
| Volume anomaly | Unusually large data retrieval | High |
| Scope violation | Accessing data outside assigned department | High |
| Privilege escalation | Using elevated privileges for data access | Critical |
| Dormant account activity | Access from inactive accounts | Critical |
| Geographic anomaly | Access from unusual locations | High |
| Service account abuse | Interactive login with service credentials | Critical |

### Detection Logic

```
Access anomaly detection:
├── Time-based
│   ├── Access outside normal working hours (per user baseline)
│   ├── Weekend/holiday access to restricted data
│   └── Sustained access sessions (> 4 hours on sensitive data)
├── Volume-based
│   ├── Records accessed > 3x baseline per session
│   ├── Bulk export or download operations
│   └── SELECT * on tables with > 10K records
├── Scope-based
│   ├── Cross-department data access without justification
│   ├── Access to data classifications above clearance
│   └── New data sources accessed for first time
└── Behavioral
    ├── Access pattern change (time, frequency, data type)
    ├── Credential sharing indicators (concurrent sessions)
    └── Pre-resignation data hoarding patterns
```

### Scanning CLI

```bash
# Analyze access logs for anomalies
node scripts/agent.js --action analyze --input /var/log/data_access.log \
  --output /tmp/access_anomalies.json

# Detect off-hours access patterns
node scripts/agent.js --action off-hours --input /var/log/data_access.log \
  --start-hour 8 --end-hour 18 --output /tmp/off_hours.json

# Detect volume anomalies
node scripts/agent.js --action volume --input /var/log/data_access.log \
  --threshold 1000 --output /tmp/volume_anomalies.json
```

## Workflow

### Step 1: Collect Access Logs

Aggregate access logs from all data stores into a central location.

### Step 2: Analyze for Anomalies

```bash
node scripts/agent.js --action analyze --input /var/log/data_access.log \
  --output /tmp/access_anomalies.json
```

### Step 3: Investigate High-Severity Findings

Cross-reference with authentication logs and HR data for context.

### Step 4: Respond and Remediate

Revoke excessive access, enforce least privilege, update detection rules.

## Detection

```yaml
title: Unauthorized Data Access Detection
id: cb641d77-3387-4f76-a96f-877eace359a5
status: experimental
description: Detects suspicious activity related to detecting unauthorized data access techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] Access logs collected from all sensitive data stores
- [ ] Behavioral baselines established per user and role
- [ ] Off-hours and volume anomaly alerts configured
- [ ] Service account access monitored separately
- [ ] Dormant account detection automated
- [ ] SIEM correlation rules active for access anomalies
- [ ] Escalation procedure defined for confirmed unauthorized access

## References

- [MITRE ATT&CK T1530 — Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
- [NIST SP 800-53 AC-2 — Account Management](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Control 6 — Access Control Management](https://www.cisecurity.org/controls)
- [SANS — Detecting Insider Threats](https://www.sans.org/white-papers/insider-threats/)
