HackBlue

Tools · Incident response playbooks · 18 / 20

Playbook: suspected insider data exfiltration

Handle suspected data theft by an employee with HR and legal from the start: preserve evidence quietly, review file, email, cloud, and USB activity, and keep the investigation fair and confidential.

10 min read · practice only with authorization

Start with HR and legal

Insider cases involve employment law, privacy, and sometimes criminal law. Before collecting, agree on the scope with HR and legal, confirm that monitoring is permitted by policy and local law, and limit the investigation team to need-to-know. Treat the person as innocent until the evidence shows otherwise.

Evidence sources

Cloud audit logs for file downloads, sharing to personal accounts, and sync clients. Email logs for large attachments to personal addresses. Endpoint data loss prevention or EDR logs for USB mass storage, printing, and uploads to personal cloud storage. Badge and VPN logs for unusual hours. Compare against the person’s normal behavior, not against everyone.

Snippet
// Microsoft 365 unified audit log via Sentinel (OfficeActivity)
OfficeActivity
| where TimeGenerated > ago(30d) and UserId =~ "j.doe@contoso.example"
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "AnonymousLinkCreated", "SharingSet")
| summarize Files = dcount(OfficeObjectId), Ops = count() by bin(TimeGenerated, 1d), Operation
| order by TimeGenerated asc

// Defender for Endpoint: USB mass storage mounts
DeviceEvents
| where ActionType == "UsbDriveMounted" and DeviceName == "FIN-LT-042"

Lab: baseline versus spike

Create a synthetic dataset of daily file download counts for one user over 60 days, with a normal range of 5 to 20 and a spike of 900 on two days near a resignation date. Plot it or compute a z-score per day to show how the spike stands out. Then write the factual, neutral summary you would give HR: what was observed, when, from which source, and what is not yet known.

Handling

Do not confront the person or alert them through account changes until HR and legal decide. Preserve evidence with chain of custody. When action is taken, coordinate account disabling, device collection, and access revocation at the same time. Afterwards, review data loss controls, offboarding procedures, and access levels.

Diagram

Insider case flow

  1. Engage HR and legal

    Agree scope, legality, and confidentiality.

  2. Preserve quietly

    Collect logs and device evidence without tipping off.

  3. Analyze against baseline

    Compare activity with the person’s own history.

  4. Coordinated action

    Revoke access and collect devices together; document facts.

Check yourself

1. Who should be involved before collecting evidence in an insider case?

2. What is the best baseline for unusual activity?

3. Why avoid disabling the account immediately in a quiet investigation?