insider-threat-detection-queries (7)

Hunt Hypothesis

Users with administrative privileges accessing sensitive data repositories at unusual times may indicate potential insider threats, as such behavior could signal data exfiltration or unauthorized access attempts. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate insider risks before they lead to data breaches or compliance violations.

KQL Query

// --------------------------------------------------------------------------------------------------------------------------- //
//
//Download Large File Volume over VPN
//
DeviceFileEvents
| where FileName endswith ".docx" or FileName endswith ".pptx" or FileName endswith ".xlsx" or FileName endswith ".pdf"
| join DeviceNetworkInfo on DeviceId 
| where ConnectedNetworks !contains '"Category":"Domain"'
| summarize TotalFiles=count() by bin(Timestamp, 5m), InitiatingProcessAccountName 
|where TotalFiles >100
| project TotalFiles,Timestamp,InitiatingProcessAccountName

Analytic Rule Definition

id: caa8bd4f-3d4c-41fb-94b2-7a3e819c1688
name: insider-threat-detection-queries (7)
description: |
  Intent:
  - Use MTP capability to look for insider threat potential risk indicators
  - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
  Definition of Insider Threat:
  "The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
  This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
  Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceNetworkInfo
tactics:
- Initial access
- Persistence
- Exfiltration
query: |
  // --------------------------------------------------------------------------------------------------------------------------- //
  //
  //Download Large File Volume over VPN
  //
  DeviceFileEvents
  | where FileName endswith ".docx" or FileName endswith ".pptx" or FileName endswith ".xlsx" or FileName endswith ".pdf"
  | join DeviceNetworkInfo on DeviceId 
  | where ConnectedNetworks !contains '"Category":"Domain"'
  | summarize TotalFiles=count() by bin(Timestamp, 5m), InitiatingProcessAccountName 
  |where TotalFiles >100
  | project TotalFiles,Timestamp,InitiatingProcessAccountName

Required Data Sources

MITRE ATT&CK Context

• Tactic: Initial access
• Tactic: Persistence
• Tactic: Exfiltration

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/General queries/insider-threat-detection-queries (7).yaml)

False Positive Guidance

• Scenario: System Backup Job Execution
  Description: A scheduled backup job (e.g., using Veeam, Commvault, or Veritas NetBackup) is executing and transferring large volumes of data across the network.
  Filter/Exclusion: Exclude traffic originating from known backup servers or jobs using source.device_type = "backup_server" or process.name = "backup_job.exe".

• Scenario: Admin Task Execution (e.g., PowerShell Script)
  Description: An administrator is running a legitimate PowerShell script (e.g., Invoke-Command, Get-EventLog, or Export-Csv) to perform routine system maintenance or data export.
  Filter/Exclusion: Exclude processes with process.user = "admin_account" or process.name = "powershell.exe" with a known command history or script signature.

• Scenario: Log File Aggregation and Transfer
  Description: A centralized logging tool (e.g., Splunk, ELK Stack, or Graylog) is transferring log files between servers or to a central repository.
  Filter/Exclusion: Exclude traffic involving destination.service = "splunk_forwarder" or source.service = "log_shipper" with known log transfer patterns.

• Scenario: Database Maintenance Task
  Description: A database maintenance task (e.g., SQL Server Agent Job, Oracle DBMS_JOB, or MySQL Event Scheduler) is performing routine data archiving or cleanup.
  Filter/Exclusion: Exclude processes with process.name = "sqlagent.exe" or process.name = "oracle_jagent" or use process.parent_process = "sqlservr.exe".

• Scenario: User-Initiated File Transfer (e.g., via SCP or SFTP)
  Description: A user is transferring files between servers using secure protocols (e