<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-insider-data-theft
description: >-
  Detect insider data theft through behavioral analytics, access pattern monitoring,
  and exfiltration channel analysis to identify employees or contractors stealing
  sensitive data via email, cloud uploads, USB, or covert channels.
domain: cybersecurity
subdomain: data-security
tags:
  - insider-threat
  - data-theft
  - ueba
  - behavioral-analytics
  - exfiltration
  - dlp
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Detecting Insider Data Theft

## Overview

Detect insider data theft through behavioral analytics, access pattern monitoring,
and exfiltration channel analysis to identify employees or contractors stealing
sensitive data via email, cloud uploads, USB, or covert channels.

Mode: `[MODE: BLUE]` — Detecting Insider Data Theft.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action analyze --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action score --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action correlate --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action analyze --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Detection

```yaml
title: Insider Data Theft Detection
id: a08e70df-eb59-4d97-9b7f-0fffb19281fc
status: experimental
description: Detects suspicious activity related to detecting insider data theft techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1048
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Insider Data Theft Detection | windows/file_access | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1048 |

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
