Insider Threat Alert: Security Professionals Turned Malicious — Detection and Prevention Strategies

---
title: Unusual Administrative Activity Outside Business Hours
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects security staff or administrators performing sensitive operations outside normal business hours
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2023/11/14
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    User|contains:
      - 'admin'
      - 'security'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\reg.exe'
      - '\sc.exe'
  timeframe: 24h
  timeframe_start: '2023-11-14T18:00:00Z'
  condition: selection
falsepositives:
  - Authorized emergency maintenance
  - Scheduled system updates
level: high
---
title: Access to Security Tools by Non-Security Personnel
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects users outside of security roles accessing security administration tools
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2023/11/14
tags:
  - attack.defense_evasion
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\security\tools\'
      - '\SIEM\'
      - '\EDR\'
      - '\forensics\'
  filter:
    User|contains:
      - 'svc_security'
      - 'admin_security'
      - 'SOC'
  condition: selection and not filter
falsepositives:
  - Authorized security assessments
  - Auditing activities
level: medium
---
title: Data Exfiltration Indicators via Network Connections
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects unusual outbound network connections that may indicate data exfiltration
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2023/11/14
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 80
      - 21
      - 22
      - 3389
    Initiated: 'true'
  filter:
    Image|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
    User|contains:
      - 'system'
      - 'network service'
      - 'local service'
  condition: selection and not filter
falsepositives:
  - Legitimate business traffic
  - Authorized remote access
level: low

// Detect unusual administrative activity by security personnel
SecurityEvent
| where EventID in (4624, 4672, 5140)  // Logon events, privileged assignment, file share access
| where SubjectUserName contains "security" or SubjectUserName contains "admin"
| where TimeGenerated between(datetime(now)-7d .. datetime(now))
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, EventID, Activity, TargetUserName, TargetDomainName
| summarize count() by SubjectUserName, EventID, bin(TimeGenerated, 1h)
| where count_ > 10  // Threshold tuning required
| order by count_ desc

// Identify security tools being accessed by non-security accounts
DeviceProcessEvents
| where FileName in~ ("powershell.exe", "cmd.exe", "net.exe", "net1.exe", "reg.exe", "sc.exe")
| where AccountName !contains "svc_security" and AccountName !contains "admin_security" and AccountName !contains "SOC"
| where ProcessCommandLine contains "security" or ProcessCommandLine contains "SIEM" or ProcessCommandLine contains "EDR"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

// Detect potential data exfiltration from security systems
DeviceNetworkEvents
| where RemotePort in (443, 80, 21, 22, 3389)
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "python.exe", "winSCP.exe", "putty.exe")
| where InitiatingProcessAccountName contains "security" or InitiatingProcessAccountName contains "admin"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, BytesSent, BytesReceived
| where BytesSent > 5000000  // 5MB threshold - adjust based on normal traffic
| order by BytesSent desc

-- Hunt for unusual administrative activities by security personnel
SELECT Timestamp, Uname, Hostname, EventID, Command, Pid
FROM pslist()
WHERE Uname =~ 'admin' OR Uname =~ 'security'
  AND Exe =~ 'powershell.exe' OR Exe =~ 'cmd.exe' OR Exe =~ 'net.exe'

-- Identify access to security-related tools and directories
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs='/*/security/tools/*')
  OR glob(globs='/*/SIEM/*') OR glob(globs='/*/EDR/*')
  OR glob(globs='/*/forensics/*')

-- Hunt for suspicious network connections initiated by security personnel
SELECT Pid, RemoteAddress, RemotePort, State, Uname, StartTime
FROM netstat()
WHERE Uname =~ 'admin' OR Uname =~ 'security'
  AND RemotePort IN (443, 80, 21, 22, 3389)

# Script to audit privileged user activities and access to security tools

# Function to audit recent privileged activities
function Audit-PrivilegedActivities {
    $events = Get-WinEvent -FilterHashtable @{
        LogName='Security'
        ID=4672  # Special privileges assigned to new logon
        StartTime=(Get-Date).AddDays(-7)
    } -ErrorAction SilentlyContinue
    
    $securityUsers = $events | Where-Object { $_.Message -match 'security|admin' } 
    return $securityUsers
}

# Function to check access permissions on security tools
function Check-SecurityToolsPermissions {
    $securityPaths = @(
        "C:\Program Files\Security",
        "C:\Program Files\SIEM",
        "C:\Program Files\EDR"
    )
    
    $results = @()
    foreach ($path in $securityPaths) {
        if (Test-Path $path) {
            $acl = Get-Acl $path
            $access = $acl.Access | Where-Object { $_.IdentityReference -notmatch 'SYSTEM|Administrators|svc_security|admin_security|SOC' }
            
            foreach ($entry in $access) {
                $results += [PSCustomObject]@{
                    Path = $path
                    User = $entry.IdentityReference
                    Rights = $entry.FileSystemRights
                    AccessControlType = $entry.AccessControlType
                }
            }
        }
    }
    return $results
}

# Function to review security group memberships
function Review-SecurityGroupMemberships {
    $groups = @("Domain Admins", "Enterprise Admins", "Security Admins", "SOC")
    $members = @()
    
    foreach ($group in $groups) {
        try {
            $groupMembers = Get-ADGroupMember -Identity $group -ErrorAction SilentlyContinue
            foreach ($member in $groupMembers) {
                $members += [PSCustomObject]@{
                    Group = $group
                    Member = $member.Name
                    SamAccountName = $member.SamAccountName
                    ObjectClass = $member.ObjectClass
                }
            }
        } catch {
            Write-Host "Could not retrieve members for group: $group"
        }
    }
    return $members
}

# Execute auditing functions
$privilegedActivities = Audit-PrivilegedActivities
$securityToolsPermissions = Check-SecurityToolsPermissions
$securityGroupMembers = Review-SecurityGroupMemberships

# Output results
Write-Host "Privileged Activities in the Last 7 Days:"
$privilegedActivities | Format-Table -AutoSize

Write-Host "`nNon-standard Permissions on Security Tools:"
$securityToolsPermissions | Format-Table -AutoSize

Write-Host "`nMembers of Security and Admin Groups:"
$securityGroupMembers | Format-Table -AutoSize