Insider Data Exfiltration Scenario

Scenario Overview

Exercise Type: Technical Deep-Dive Simulation Target Audience: SOC Analysts, Infrastructure Engineers, Data Loss Prevention Teams Scenario: Insider Threat Exploiting DevOps Access for Data Theft Duration: 180-210 minutes Exercise Objective: Validate detection and response capabilities against credentialed insider attacks targeting intellectual property

Facilitator Guidelines

Emphasize behavioral analytics alongside technical indicators
Highlight cloud forensics and log correlation challenges
Track evidence chain-of-custody requirements
Simulate pressure from executive stakeholders

Exercise Script

INJECT 1: Network Anomaly Detection (Day 1 - 08:12 AM)

Situation:

Quarterly network audit reveals:
- 4.2GB nightly TLS 1.3 transfers from alex.rivera@[WithPCI.com Company Name].com to pCloud storage
- Pattern: 01:14-03:47 AM local time across 12 business days
- Alex Rivera holds Principal DevOps Engineer role with:
  - AWS IAM Admin privileges
  - GitHub Organization Owner status
  - Access to HashiCorp Vault clusters

Facilitator Notes:

Observe initial triage procedures
Note discussions about off-hours activity baselines

DISCUSSION PROMPT: "What investigative steps would you take? How balance employee privacy vs. security needs?"

INJECT 2: Credential Anomalies (Day 1 - 09:20 AM)

Situation:

Azure AD logs show:
- 19 consecutive logins from São Paulo (GMT-3) during Rivera's typical off-hours
- Session durations averaging 3h48m with no active screen locks
Carbon Black detects:
- v2ray proxy client in %LOCALAPPDATA%\Temp\v2rayN
- megatools CLI binary masquerading as dllhost.exe

Facilitator Notes:

Evaluate understanding of living-off-the-land techniques
Note discussions about geo-velocity alerts

DISCUSSION PROMPT: "What containment measures prevent further exfiltration? How validate endpoint compromise scope?"

INJECT 3: Evasive Transfer Patterns (Day 1 - 10:45 AM)

Situation:

Process lineage analysis reveals:
- notepad.exe spawning cmd.exe with parameters: "/c megatools dl --path=C:\Temp\cache --config=mega.ini --disable-previews"
- 278GB transferred over 14 days to encrypted pCloud folders
Network packet captures show:
- TLS fingerprint spoofing as Chrome 121 traffic
- Domain fronting through Cloudflare CDN

Facilitator Notes:

Assess CDN forensic capabilities
Note discussions about egress traffic profiling

DISCUSSION PROMPT: "How would you block disguised C2 traffic? What log sources provide definitive proof?"

INJECT 4: Privilege Escalation (Day 1 - 01:00 PM)

Situation:

Okta audit trail shows:
- Temporary Okta Groups created with names matching tmp-*
- Groups granted read access to:
  - Workday API credentials
  - Salesforce Sandbox environments
  - Merger & Acquisition SharePoint sites
- Auto-deletion rules set for 8-hour lifespan

Facilitator Notes:

Evaluate privileged access management controls
Note discussions about Just-In-Time access workflows

DISCUSSION PROMPT: "What IAM policy changes prevent group lifecycle abuse? How detect phantom group creation?"

INJECT 5: Code Exposure (Day 1 - 03:35 PM)

Situation:

Data Loss Prevention system alerts on:
- 2.1GB design_specs.7z uploaded via OnionShare
- Contains:
  - Embedded systems firmware source code
  - Mechanical CAD files with export controls
  - config.env files with plaintext Okta API tokens
Reverse engineering reveals tokens grant:
- Full SCIM user provisioning access
- Ability to disable MFA enforcement

Facilitator Notes:

Highlight secrets management failures
Note discussions about air-gapped development environments

DISCUSSION PROMPT: "What credential rotation strategy contains exposure? How validate code repository integrity?"

INJECT 5A: Orphaned System Impact (Day 1 - 04:20 PM)

Situation:

Infrastructure audit uncovers:
- logging-aggregator-05 server last updated 18 months ago
- No assigned owner after lead architect's departure
- Running unpatched Logstash 6.8 with CVE-2024-3159
Server contains:
- 12 months of raw PII logs
- AWS STS temporary credentials in log entries

Facilitator Notes:

Assess asset inventory accuracy
Note discussions about legacy system retirement

DISCUSSION PROMPT: "What containment measures for unmanaged assets? How prevent credential leakage via logs?"

INJECT 6: Service Account Abuse (Day 1 - 05:50 PM)

Situation:

Active Directory analysis shows:
- Dormant svc_ansible_runner account re-enabled
- Added to Global Infrastructure Admins group
- Used to deploy Ansible playbook with:

- name: Backup configs
  win_shell: |
    Compress-Archive -Path C:\AppConfigs\* -DestinationPath \\share\backup\$HOSTNAME.zip

Playbook executed across 142 Windows servers

Facilitator Notes:

Evaluate configuration management safeguards
Note discussions about backup validation

DISCUSSION PROMPT: "How detect malicious playbook execution? What credential lifecycle controls failed?"

INJECT 7: Credential Harvesting (Day 2 - 08:10 AM)

Situation:

Elastic Endgame detects:
- explorer.exe injecting into spoolsv.exe
- LSASS memory dump written to C:\Windows\Temp\lsass.bin
- File transfer to Romanian IP 89.34.209.77 via WebDAV
Registry analysis reveals:
- HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential=1

Facilitator Notes:

Highlight attacker tradecraft sophistication
Note discussions about credential guard deployment

DISCUSSION PROMPT: "What authentication protocol hardening is needed? How investigate lateral movement potential?"

INJECT 8: Database Exfiltration (Day 2 - 09:45 AM)

Situation:

MySQL audit logs show:
- BACKUP DATABASE commands executed via db_archiver account
- 12.7TB of data staged in /var/www/static/export/
- wget commands downloading archives to .onion addresses
Account security review reveals:
- Password unchanged for 1,142 days
- MFA never configured despite policy

Facilitator Notes:

Assess database activity monitoring coverage
Note discussions about backup encryption

DISCUSSION PROMPT: "What database hardening steps prevent unauthorized exports? How validate backup integrity?"

INJECT 9: Dark Web Exposure (Day 2 - 11:15 AM)

Situation:

Threat intelligence identifies:
- DDoSecrets posting 78GB "_[WithPCI.com Company Name]_blueprints.tar.xz"
- Magnet link shared across 14 cybercriminal Telegram channels
- Code signatures match internal build servers
Vulnerability research shows:
- Hardcoded credentials in industrial control system firmware

Facilitator Notes:

Evaluate external monitoring capabilities
Note discussions about bug bounty program scope

DISCUSSION PROMPT: "What containment measures for leaked IP? How communicate with affected customers?"

INJECT 10: Forensic Imaging (Day 2 - 01:30 PM)

Situation:

CISO mandates:
- Physical seizure of Rivera's Lenovo ThinkPad P16
- Full memory capture via FTK Imager
- Triage of 14 USB devices connected in past 90 days
Initial findings:
- VeraCrypt container mounted 43 times
- WSL instance running custom data parsing scripts

Facilitator Notes:

Highlight forensic tool proficiency
Note discussions about legal hold procedures

DISCUSSION PROMPT: "What evidence preservation steps ensure admissibility? How handle encrypted containers?"

INJECT 11: Visibility Gaps (Day 2 - 03:00 PM)

Situation:

Post-mortem reveals:
- CloudTrail logging disabled for "cost optimization"
- 92% of S3 buckets lack access logging
- VPC Flow Logs retention set to 7 days (vs 90-day policy)
Impact assessment shows:
- 18-day detection delay from initial compromise

Facilitator Notes:

Assess cost vs. security tradeoff decisions
Note discussions about immutable audit trails

DISCUSSION PROMPT: "What logging standards enforcement mechanisms failed? How justify monitoring costs to finance?"

INJECT 12: Post-Incident Review (Day 2 - 04:30 PM)

Situation:

Remediation status:
- 100% credential rotation completed
- 78% of exposed systems rebuilt
- $2.1M in incident response costs accrued
Outstanding challenges:
- 14% of source code remains unaccounted for
- Three regulatory investigations pending

Facilitator Notes:

Focus on security program maturity metrics
Note discussions about board-level reporting

DISCUSSION PROMPT: "What KPIs measure recovery success? How transform insider risk management practices?"

Exercise Debrief

Technical Focus Areas:

Cloud Storage Access Monitoring
Privileged Session Analytics
Build System Integrity Verification
Forensic Readiness Planning
Insider Threat Behavioral Indicators

After-Action Deliverables:

Software Supply Chain Attestation Framework
Mandatory USB Device Encryption Policy
Cloud Logging Governance Model
Insider Risk Scorecard Development

Next Steps:

Implement UEBA for DevOps teams
Conduct purple team exercise testing credential theft
Schedule semi-annual forensic readiness audits