Initial commit - 611 cybersecurity skills across all subdomains

skills/detecting-insider-threat-behaviors/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: detecting-insider-threat-behaviors
+description: Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
+domain: cybersecurity
+subdomain: threat-hunting
+tags: [threat-hunting, mitre-attack, insider-threat, data-theft, ueba, proactive-detection]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+
+# Detecting Insider Threat Behaviors
+
+## When to Use
+
+- When proactively hunting for indicators of detecting insider threat behaviors in the environment
+- After threat intelligence indicates active campaigns using these techniques
+- During incident response to scope compromise related to these techniques
+- When EDR or SIEM alerts trigger on related indicators
+- During periodic security assessments and purple team exercises
+
+## Prerequisites
+
+- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
+- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
+- Sysmon deployed with comprehensive configuration
+- Windows Security Event Log forwarding enabled
+- Threat intelligence feeds for IOC correlation
+
+## Workflow
+
+1. **Formulate Hypothesis**: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
+2. **Identify Data Sources**: Determine which logs and telemetry are needed to validate or refute the hypothesis.
+3. **Execute Queries**: Run detection queries against SIEM and EDR platforms to collect relevant events.
+4. **Analyze Results**: Examine query results for anomalies, correlating across multiple data sources.
+5. **Validate Findings**: Distinguish true positives from false positives through contextual analysis.
+6. **Correlate Activity**: Link findings to broader attack chains and threat actor TTPs.
+7. **Document and Report**: Record findings, update detection rules, and recommend response actions.
+
+## Key Concepts
+
+| Concept | Description |
+|---------|-------------|
+| T1078 | Valid Accounts |
+| T1530 | Data from Cloud Storage Object |
+| T1567 | Exfiltration Over Web Service |
+
+## Tools & Systems
+
+| Tool | Purpose |
+|------|---------|
+| CrowdStrike Falcon | EDR telemetry and threat detection |
+| Microsoft Defender for Endpoint | Advanced hunting with KQL |
+| Splunk Enterprise | SIEM log analysis with SPL queries |
+| Elastic Security | Detection rules and investigation timeline |
+| Sysmon | Detailed Windows event monitoring |
+| Velociraptor | Endpoint artifact collection and hunting |
+| Sigma Rules | Cross-platform detection rule format |
+
+## Common Scenarios
+
+1. **Scenario 1**: Employee downloading bulk files before resignation
+2. **Scenario 2**: IT admin accessing HR data outside job function
+3. **Scenario 3**: Service account used for unauthorized data queries
+4. **Scenario 4**: Contractor copying source code to personal cloud storage
+
+## Output Format
+
+```
+Hunt ID: TH-DETECT-[DATE]-[SEQ]
+Technique: T1078
+Host: [Hostname]
+User: [Account context]
+Evidence: [Log entries, process trees, network data]
+Risk Level: [Critical/High/Medium/Low]
+Confidence: [High/Medium/Low]
+Recommended Action: [Containment, investigation, monitoring]
+```