<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-insider-threat-investigation
description: >-
  Investigate insider threat incidents including data exfiltration, sabotage, privilege abuse, and policy violations with behavioral analysis and evidence preservation.
domain: cybersecurity
subdomain: incident-response
tags:
  - insider-threat
  - ueba
  - data-exfiltration
  - privilege-abuse
  - behavioral-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1052", "T1078", "T1074", "T1048"]
  nist-csf: ["DE.CM-3", "RS.AN-1"]
---

# Performing Insider Threat Investigation

## Overview

Insider threat investigations require balancing thoroughness with legal and HR constraints. Evidence must be collected in a manner that preserves chain of custody and adheres to employment law. Investigation scope, authorization level, and disclosure obligations vary significantly by jurisdiction.

Mode: `[MODE: INCIDENT]` — Get legal and HR involved before collecting evidence. Document everything.

**Prerequisite:** Obtain explicit written authorization from Legal and HR leadership before any covert monitoring or data collection.

## Insider Threat Categories

| Category | Examples | Primary Motivation | ATT&CK |
|---|---|---|---|
| Data theft | IP exfiltration before departure, selling trade secrets | Financial, competitive | T1048, T1052 |
| Sabotage | Deleting files, corrupting databases, logic bombs | Revenge, grievance | T1485, T1489 |
| Privilege abuse | Accessing unauthorized data, credential sharing | Curiosity, intent to harm | T1078, T1213 |
| Fraud | Financial system manipulation, falsifying records | Financial gain | T1565 |
| Espionage | Nation-state recruitment, corporate espionage | Ideological, financial | T1074, T1213 |

## Investigation Phases

| Phase | Actions | Legal Touchpoint |
|---|---|---|
| Allegation receipt | Document allegation, assess credibility | HR notification, privilege review |
| Scope definition | Identify subject, time window, data at risk | Legal authorization, scope boundaries |
| Evidence preservation | Legal hold on email/files, disable overwrites | Legal hold notice issued |
| Behavioral analysis | UEBA review, access log analysis, DLP alerts | Proportionality review |
| Technical investigation | Deep dive on specific artifacts | Chain of custody start |
| Findings review | Document evidence, assess severity | Legal + HR review before action |
| Closure | Remediation, HR action, or criminal referral | Attorney briefing |

## Evidence Sources

| Source | What to Collect | Retention Check |
|---|---|---|
| DLP alerts | Exfiltration events by subject before and during window | Confirm logs not expired |
| CASB / cloud activity | File downloads, sharing, sync activity | Cloud provider retention policy |
| Email logs | External sends, large attachments, personal email from work | Exchange/Google Vault |
| Endpoint activity | USB activity (EID 2003), file copies, print jobs | EDR telemetry retention |
| Access logs | Badge records, after-hours access, remote login | Physical security system |
| UEBA baseline | Deviation scores, peer comparison, risk timeline | UEBA platform |

## Behavioral Indicators

| Indicator | Signal | False Positive |
|---|---|---|
| Large file transfer before resignation | User emails large archive to personal account | Legitimate remote work file transfer |
| After-hours access spike | 3am logins to file server not normal for role | On-call rotation, timezone difference |
| Mass download from SharePoint | 10x normal daily download volume | Project delivery, backup activity |
| Privilege escalation attempts | Repeated access to unauthorized resources | Misconfigured permissions, automation |
| USB device insertion | First-ever USB use in last 30 days | Hardware troubleshooting, approved device |

## Chain of Custody Requirements

- Every evidence item logged with: collector identity, collection time, tool used, hash value
- Disk images signed with SHA-256 before and after collection
- Physical evidence in tamper-evident packaging with seal integrity record
- Investigation timeline maintained as immutable append-only log
- All investigator access to evidence recorded

## Verification

- [ ] Written authorization obtained from Legal and HR before investigation start
- [ ] Legal hold placed on subject's data before any collection
- [ ] All evidence hashed and chain of custody documented
- [ ] Investigation scope confirmed with Legal (no overreach)
- [ ] Findings report reviewed by Legal before any HR action
- [ ] Subject notification obligations assessed per jurisdiction

## Related Techniques

- [Performing Digital Forensics Investigation](../../../digital-forensics/techniques/performing-cloud-forensics-investigation/SKILL.md)
- [Building Insider Threat Program](../../../security-architecture/techniques/implementing-defense-in-depth/SKILL.md)
