PHASE: Insider Threat Indicators50% COMPLETION
Abort Mission
MODULE 19

Insider Threat Hunting

Detecting anomalous user behavior and unauthorized access.

Insider Threat Indicators

Insider threats are difficult to detect because they have legitimate access.

Data Hoarding: Accessing unusual amounts of data
Off-Hours Access: Logging in at unusual times
Privilege Abuse: Accessing unauthorized resources