Analytics Story: Insider Threat

Updated Date: 2026-05-13 ID: c633df29-a950-4c4c-a0f8-02be6730797c Author: Jose Hernandez, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.

Why it matters

Insider Threats are best defined by CISA: "Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs." An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
Gsuite Drive Share In External Email	Exfiltration to Cloud Storage	Anomaly
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials	Password Spraying	TTP
Windows Multiple Users Failed To Authenticate From Process	Password Spraying	TTP
Detect Remote Access Software Usage URL	Remote Access Tools	Anomaly
Windows Unusual Count Of Users Failed To Authenticate From Process	Password Spraying	Anomaly
Windows RMM Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	Anomaly
Potential password in username	Local Accounts, Credentials In Files	Hunting
Detect Remote Access Software Usage Registry	Remote Access Tools	Anomaly
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials	Password Spraying	Anomaly
Gsuite Outbound Email With Attachment To External Domain	Exfiltration Over Unencrypted Non-C2 Protocol	Hunting
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
High Frequency Copy Of Files In Network Share	Transfer Data to Cloud Account	Anomaly
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
G Suite Drive	Other	`gsuite:drive:json`	`http:gsuite`
Windows Event Log Security 4648	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4625	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Palo Alto Network Threat	Network	`pan:threat`	`not_applicable`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Linux Secure	Linux	`linux_secure`	`/var/log/secure`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
G Suite Gmail	Other	`gsuite:gmail:bigquery`	`http:gsuite`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 2