Insider Threat Defense: Detecting Ransomware Negotiator Compromise

---
title: Potential Insider Access to Sensitive Negotiation Data
id: 8a1c2b3d-4e5f-6789-0a1b-2c3d4e5f6789
status: experimental
description: Detects access to sensitive directories containing client data or negotiation logs by non-standard processes or unusual users.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\Clients\'
      - '\\Negotiations\'
      - '\\CaseFiles\'
      - '\\Evidence\'
  filter_legit_apps:
    Image|contains:
      - '\\explorer.exe'
      - '\\winword.exe'
      - '\\excel.exe'
  condition: selection and not filter_legit_apps
falsepositives:
  - Legitimate access by IR staff using custom tools for bulk processing
level: high
---
title: Execution of Tor Browser on Corporate Infrastructure
id: 9b2d3e4f-5f60-7890-1b2c-3d4e5f67890a
status: experimental
description: Detects the execution of Tor Browser on endpoints within the corporate network, a common vector for C2 or data leakage by insiders.
references:
  - https://attack.mitre.org/techniques/T1090/ 
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1090.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: '\\Tor Browser\\Browser\firefox.exe'
    or
    CommandLine|contains: 'tor.exe'
  condition: selection
falsepositives:
  - Authorized research by security teams (rare, should be allowlisted by hostname)
level: critical
---
title: Suspicious PowerShell Data Exfiltration Patterns
id: 0c3e4f5g-6g71-8901-2c3d-4e5f67890a1b
status: experimental
description: Detects PowerShell commands often used to compress and exfiltrate data, indicative of insider data theft.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'Compress-Archive'
      - 'Invoke-WebRequest'
      - 'Out-File'
      - '-Encoding Byte'
  condition: selection
falsepositives:
  - Administrative scripting tasks (verify user context)
level: medium

let HighRiskAccounts = Materialize (
    IdentityInfo
    | where AssignedRoles has_any ('Administrator', 'Incident Responder', 'Negotiator')
    | project AccountName, AccountUPN
);
DeviceProcessEvents 
| where Timestamp > ago(24h)
| where InitiatingProcessAccountName in (HighRiskAccounts) 
| where (ProcessCommandLine contains 'Compress-Archive' or ProcessCommandLine contains 'Copy-Item' or ProcessCommandLine contains 'Invoke-RestMethod')
| extend FileName = tostring(split(FileName, '\')[-1])
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

-- Hunt for indicators of covert communication channels and data staging
SELECT 
  OSPath,
  Size,
  Mtime,
  Hash.DATA as Hash
FROM glob(globs=\"\\\Users\\\*\\\AppData\\\Local\\\Tor\\\*\")
WHERE NOT Mtime < ago(-30d)

UNION

SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Username, 
  Exe
FROM pslist()
WHERE Name =~ \"firefox.exe\" 
   AND Exe =~ \"Tor Browser\"
   OR CommandLine =~ \"socks\"

# Audit Local Administrators and Check for Suspicious Scheduled Tasks
# Must be run as Administrator

Write-Host \"[+] Auditing Local Administrators Group...\"
$Admins = Get-LocalGroupMember -Group \"Administrators\" -ErrorAction SilentlyContinue
if ($Admins) {
    $Admins | Select-Object ObjectClass, Name, SID | Format-Table -AutoSize
} else {
    Write-Host \"[-] No local administrators found or access denied.\"
}

Write-Host \"[+] Scanning for Suspicious Scheduled Tasks (tasks created by non-system accounts)...\"
$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Principal.UserId -and 
    $_.Principal.UserId -notmatch \"^(SYSTEM|LOCAL SERVICE|NETWORK SERVICE|Administrators)$\" 
}

if ($SuspiciousTasks) {
    foreach ($task in $SuspiciousTasks) {
        Write-Host \"[!] Potential Rogue Task Found: $($task.TaskName) by user $($task.Principal.UserId)\"
        $task.Actions | Format-List
    }
} else {
    Write-Host \"[+] No obvious rogue scheduled tasks detected.\"
}

Write-Host \"[+] Checking for common RMM/Remote Access tools...\"
$RMMProcesses = @(\"TeamViewer\", \"AnyDesk\", \"Splashtop\", \"ScreenConnect\", \"RemoteDesktopManager\")
$RunningProcesses = Get-Process

foreach ($proc in $RunningProcesses) {
    if ($RMMProcesses -contains $proc.ProcessName) {
        Write-Host \"[!] Detected RMM Tool: $($proc.ProcessName) - PID: $($proc.Id) - Path: $($proc.Path)\"
    }
}