insider-threat-detection-queries (15)

Hunt Hypothesis

Users with administrative privileges accessing sensitive data repositories at unusual times may indicate potential insider threats, as such behavior could signal data exfiltration or unauthorized access attempts. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate insider risks before they lead to data breaches or compliance violations.

KQL Query

// --------------------------------------------------------------------------------------------------------------------------- //
//
//After-Hours Login
//
//Change the StartTime and EndTime to reflect typical working hours
//This query needs some adjustments, as the default for a datetime object with no date is to only query "today"
let StartTime = datetime("8:00:00 AM");
let EndTime = datetime("5:00:00 PM");
DeviceLogonEvents
| where InitiatingProcessAccountName != "system"
| where Timestamp between ((EndTime) .. StartTime)

Analytic Rule Definition

id: 659e686d-850e-4240-a339-b24928f95e90
name: insider-threat-detection-queries (15)
description: |
  Intent:
  - Use MTP capability to look for insider threat potential risk indicators
  - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
  Definition of Insider Threat:
  "The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
  This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
  Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
tactics:
- Initial access
- Persistence
- Exfiltration
query: |
  // --------------------------------------------------------------------------------------------------------------------------- //
  //
  //After-Hours Login
  //
  //Change the StartTime and EndTime to reflect typical working hours
  //This query needs some adjustments, as the default for a datetime object with no date is to only query "today"
  let StartTime = datetime("8:00:00 AM");
  let EndTime = datetime("5:00:00 PM");
  DeviceLogonEvents
  | where InitiatingProcessAccountName != "system"
  | where Timestamp between ((EndTime) .. StartTime)

Required Data Sources

MITRE ATT&CK Context

• Tactic: Initial access
• Tactic: Persistence
• Tactic: Exfiltration

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/General queries/insider-threat-detection-queries (15).yaml)

False Positive Guidance

• Scenario: System Backup Job Execution
  Description: A scheduled backup job (e.g., using Veeam Backup & Replication or Commvault) is executing and transferring large volumes of data across the network, which could be mistaken for data exfiltration.
  Filter/Exclusion: Exclude traffic associated with known backup tools or system jobs (e.g., Veeam, Commvault, or rsync with job-specific command-line arguments).

• Scenario: Admin Task for Patch Management
  Description: An administrator is performing a patch deployment using SCCM (System Center Configuration Manager) or Ansible, which involves copying files across the network and may trigger the rule.
  Filter/Exclusion: Exclude traffic from known admin tools (e.g., SCCM, Ansible, or WSUS) or filter based on IP ranges used for internal patch management.

• Scenario: Log File Transfer for SIEM Integration
  Description: A log aggregation task (e.g., using Splunk or ELK Stack) is transferring logs from multiple servers to a central SIEM, which may be flagged as suspicious data movement.
  Filter/Exclusion: Exclude traffic from log collection tools (e.g., Splunk Universal Forwarder, Filebeat, or Logstash) or filter based on known log transfer protocols (e.g., syslog, TCP 514).

• Scenario: User-Initiated File Sync via Cloud Storage
  Description: A user is syncing files to a cloud storage service (e.g., OneDrive, Google Drive, or Dropbox) using a company-issued device, which may be flagged as potential data exfiltration.
  Filter/Exclusion: Exclude traffic from known cloud sync tools (e.g., OneDrive sync client,