Insider Threat Detection: Behavioral Analytics with Wazuh#

1
# Wazuh Behavioral Analytics Engine
2
class InsiderThreatDetector:
3
    def __init__(self):
4
        self.baseline_window = 30  # days
5
        self.anomaly_threshold = 3.0  # standard deviations
6
        self.risk_factors = {
7
            'after_hours_access': 2.0,
8
            'excessive_downloads': 3.0,
9
            'unusual_applications': 2.5,
10
            'privilege_escalation': 4.0,
11
            'data_staging': 5.0
12
        }
13

14
    def calculate_risk_score(self, user_activity):
15
        """Calculate composite insider risk score"""
16
        base_score = 0
17
        for activity, weight in self.risk_factors.items():
18
            if self.is_anomalous(user_activity, activity):
19
                base_score += weight * self.get_deviation(user_activity, activity)
20
        return min(base_score, 100)  # Cap at 100

1
<!-- Baseline Collection Rules -->
2
<group name="insider_threat,baseline">
3
  <!-- Working Hours Baseline -->
4
  <rule id="300001" level="0">
5
    <if_sid>18104,18105,18106</if_sid>
6
    <time>0800-1800</time>
7
    <weekday>monday,tuesday,wednesday,thursday,friday</weekday>
8
    <description>Baseline: Normal working hours authentication</description>
9
    <options>no_log</options>
10
  </rule>
11

12
  <!-- File Access Baseline -->
13
  <rule id="300002" level="0">
14
    <if_sid>80784</if_sid>
15
    <field name="win.eventdata.objectType">^File$</field>
16
    <field name="win.eventdata.accesses">%%4416|%%4417</field>
17
    <description>Baseline: Normal file read access</description>
18
    <options>no_log</options>
19
  </rule>
20

21
  <!-- Application Usage Baseline -->
22
  <rule id="300003" level="0">
23
    <if_sid>61603</if_sid>
24
    <field name="win.eventdata.image" type="pcre2">Office|Chrome|Explorer</field>
25
    <description>Baseline: Standard application execution</description>
26
    <options>no_log</options>
27
  </rule>
28
</group>

1
<!-- Suspicious After-Hours Access -->
2
<rule id="300010" level="8">
3
  <if_sid>18104</if_sid>
4
  <time>2000-0600</time>
5
  <weekday>monday,tuesday,wednesday,thursday,friday</weekday>
6
  <description>Insider Threat: After-hours login detected</description>
7
  <group>insider_threat,after_hours</group>
8
  <mitre>
9
    <id>T1078</id>
10
  </mitre>
11
</rule>
12

13
<!-- Weekend Access Anomaly -->
14
<rule id="300011" level="9">
15
  <if_sid>18104</if_sid>
16
  <weekday>saturday,sunday</weekday>
17
  <field name="win.eventdata.logonType">^10$</field>
18
  <description>Insider Threat: Weekend remote access detected</description>
19
  <group>insider_threat,weekend_access</group>
20
</rule>
21

22
<!-- Multiple After-Hours Sessions -->
23
<rule id="300012" level="12" frequency="3" timeframe="86400">
24
  <if_matched_rules>300010,300011</if_matched_rules>
25
  <same_field>win.eventdata.targetUserName</same_field>
26
  <description>Insider Threat: Pattern of suspicious after-hours activity</description>
27
  <group>insider_threat,behavioral_anomaly</group>
28
</rule>

1
<!-- Mass File Access Detection -->
2
<rule id="300020" level="7">
3
  <if_sid>80784</if_sid>
4
  <field name="win.eventdata.objectType">^File$</field>
5
  <field name="win.eventdata.objectName" type="pcre2">\.(xlsx?|docx?|pdf|pptx?)$</field>
6
  <description>Insider Threat: Sensitive document access</description>
7
</rule>
8

9
<rule id="300021" level="11" frequency="50" timeframe="3600">
10
  <if_matched_rules>300020</if_matched_rules>
11
  <same_field>win.eventdata.subjectUserName</same_field>
12
  <description>Insider Threat: Mass document access - possible data harvesting</description>
13
  <group>insider_threat,data_exfiltration</group>
14
  <mitre>
15
    <id>T1005</id>
16
  </mitre>
17
</rule>
18

19
<!-- USB Device Usage -->
20
<rule id="300022" level="10">
21
  <if_sid>80700</if_sid>
22
  <field name="win.eventdata.className">^USB$</field>
23
  <field name="win.eventdata.deviceDescription" type="pcre2">Mass Storage|Removable</field>
24
  <description>Insider Threat: USB storage device connected</description>
25
  <group>insider_threat,removable_media</group>
26
</rule>
27

28
<!-- Large File Transfers -->
29
<rule id="300023" level="9">
30
  <if_sid>5706</if_sid>
31
  <field name="data.total_bytes" compare="greater">104857600</field>
32
  <description>Insider Threat: Large file transfer detected (>100MB)</description>
33
</rule>
34

35
<rule id="300024" level="13" frequency="5" timeframe="3600">
36
  <if_matched_rules>300023</if_matched_rules>
37
  <same_source_ip />
38
  <description>Insider Threat: Multiple large file transfers - exfiltration suspected</description>
39
  <group>insider_threat,data_exfiltration</group>
40
  <mitre>
41
    <id>T1041</id>
42
  </mitre>
43
</rule>

1
<!-- Unauthorized Privilege Changes -->
2
<rule id="300030" level="10">
3
  <if_sid>60110</if_sid>
4
  <field name="win.eventdata.targetUserName" negate="yes">admin|administrator</field>
5
  <field name="win.eventdata.privilegeList" type="pcre2">SeDebugPrivilege|SeTakeOwnershipPrivilege</field>
6
  <description>Insider Threat: Suspicious privilege use by non-admin</description>
7
  <group>insider_threat,privilege_abuse</group>
8
  <mitre>
9
    <id>T1078</id>
10
  </mitre>
11
</rule>
12

13
<!-- Admin Group Modifications -->
14
<rule id="300031" level="12">
15
  <if_sid>60105</if_sid>
16
  <field name="win.eventdata.targetSid">S-1-5-32-544</field>
17
  <field name="win.eventdata.subjectUserName" negate="yes">admin_service</field>
18
  <description>Insider Threat: Unauthorized addition to Administrators group</description>
19
  <group>insider_threat,privilege_escalation</group>
20
  <mitre>
21
    <id>T1098</id>
22
  </mitre>
23
</rule>
24

25
<!-- Service Account Abuse -->
26
<rule id="300032" level="11">
27
  <if_sid>18104</if_sid>
28
  <field name="win.eventdata.targetUserName" type="pcre2">^svc_|^service_</field>
29
  <field name="win.eventdata.logonType">^(2|10)$</field>
30
  <description>Insider Threat: Interactive logon with service account</description>
31
  <group>insider_threat,account_abuse</group>
32
</rule>

1
<!-- Deviation from Normal Patterns -->
2
<rule id="300040" level="0">
3
  <decoded_as>behavioral_analytics</decoded_as>
4
  <description>Behavioral Analytics Engine</description>
5
  <options>no_log</options>
6
</rule>
7

8
<!-- Application Anomaly -->
9
<rule id="300041" level="8">
10
  <if_sid>61603</if_sid>
11
  <field name="win.eventdata.image" type="pcre2">psexec|mimikatz|lazagne|procdump</field>
12
  <description>Insider Threat: Suspicious tool execution</description>
13
  <group>insider_threat,suspicious_process</group>
14
  <mitre>
15
    <id>T1003</id>
16
  </mitre>
17
</rule>
18

19
<!-- Unusual Network Connections -->
20
<rule id="300042" level="9">
21
  <if_sid>5156</if_sid>
22
  <field name="win.eventdata.destinationPort">^(1337|4444|8080|31337)$</field>
23
  <field name="win.eventdata.direction">^%%14593$</field>
24
  <description>Insider Threat: Connection to suspicious port</description>
25
  <group>insider_threat,network_anomaly</group>
26
</rule>

1
<!-- Risk Score Calculation Rules -->
2
<rule id="300050" level="6" frequency="2" timeframe="3600">
3
  <if_group>insider_threat</if_group>
4
  <same_field>data.srcuser</same_field>
5
  <description>Insider Risk: Low - Multiple suspicious activities</description>
6
  <group>risk_score_low</group>
7
</rule>
8

9
<rule id="300051" level="10" frequency="4" timeframe="3600">
10
  <if_group>insider_threat</if_group>
11
  <same_field>data.srcuser</same_field>
12
  <description>Insider Risk: Medium - Pattern of concerning behavior</description>
13
  <group>risk_score_medium</group>
14
</rule>
15

16
<rule id="300052" level="14" frequency="6" timeframe="3600">
17
  <if_group>insider_threat</if_group>
18
  <same_field>data.srcuser</same_field>
19
  <description>Insider Risk: High - Multiple high-risk activities detected</description>
20
  <group>risk_score_high</group>
21
</rule>
22

23
<rule id="300053" level="15" frequency="8" timeframe="3600">
24
  <if_group>insider_threat</if_group>
25
  <same_field>data.srcuser</same_field>
26
  <different_rule_id />
27
  <description>Insider Risk: Critical - Immediate investigation required</description>
28
  <group>risk_score_critical</group>
29
</rule>

1
# ML-based Behavioral Analysis
2
import numpy as np
3
from sklearn.ensemble import IsolationForest
4
from sklearn.preprocessing import StandardScaler
5

6
class UserBehaviorAnalyzer:
7
    def __init__(self, contamination=0.01):
8
        self.model = IsolationForest(
9
            contamination=contamination,
10
            random_state=42,
11
            n_estimators=200
12
        )
13
        self.scaler = StandardScaler()
14
        self.feature_names = [
15
            'login_hour_deviation',
16
            'daily_file_access_count',
17
            'unique_systems_accessed',
18
            'data_transfer_volume',
19
            'privilege_use_frequency',
20
            'application_diversity'
21
        ]
22

23
    def extract_features(self, user_logs):
24
        """Extract behavioral features from user logs"""
25
        features = []
26

27
        # Time-based features
28
        login_hours = [log['hour'] for log in user_logs if log['event'] == 'login']
29
        avg_hour = np.mean(login_hours) if login_hours else 12
30
        hour_std = np.std(login_hours) if len(login_hours) > 1 else 0
31

32
        # Access patterns
33
        file_accesses = len([log for log in user_logs if log['event'] == 'file_access'])
34
        unique_systems = len(set([log['system'] for log in user_logs]))
35

36
        # Data movement
37
        data_volume = sum([log.get('bytes', 0) for log in user_logs])
38

39
        # Privilege usage
40
        priv_events = len([log for log in user_logs if log.get('privileged', False)])
41

42
        # Application diversity
43
        unique_apps = len(set([log.get('application', '') for log in user_logs]))
44

45
        features = [hour_std, file_accesses, unique_systems,
46
                   data_volume, priv_events, unique_apps]
47

48
        return np.array(features).reshape(1, -1)
49

50
    def detect_anomalies(self, user_logs):
51
        """Detect anomalous user behavior"""
52
        features = self.extract_features(user_logs)
53
        features_scaled = self.scaler.transform(features)
54

55
        # Predict: -1 for anomaly, 1 for normal
56
        prediction = self.model.predict(features_scaled)
57
        anomaly_score = self.model.score_samples(features_scaled)[0]
58

59
        return {
60
            'is_anomaly': prediction[0] == -1,
61
            'anomaly_score': float(anomaly_score),
62
            'risk_level': self.calculate_risk_level(anomaly_score)
63
        }
64

65
    def calculate_risk_level(self, score):
66
        """Convert anomaly score to risk level"""
67
        if score < -0.5:
68
            return 'CRITICAL'
69
        elif score < -0.3:
70
            return 'HIGH'
71
        elif score < -0.1:
72
            return 'MEDIUM'
73
        else:
74
            return 'LOW'

1
<!-- Finance-Specific Monitoring -->
2
<rule id="300060" level="10">
3
  <if_sid>300020</if_sid>
4
  <field name="win.eventdata.objectName" type="pcre2">financial|payroll|salary|budget</field>
5
  <field name="data.department">^(?!Finance$)</field>
6
  <description>Insider Threat: Non-finance employee accessing financial data</description>
7
  <group>insider_threat,unauthorized_access</group>
8
</rule>
9

10
<!-- Sensitive Report Generation -->
11
<rule id="300061" level="11">
12
  <if_sid>87001</if_sid>
13
  <field name="application.name">^SAP$|^Oracle Financials$</field>
14
  <field name="application.action">^export_report$</field>
15
  <time>1800-0800</time>
16
  <description>Insider Threat: Financial report exported after hours</description>
17
  <group>insider_threat,data_export</group>
18
</rule>

1
<!-- HR Data Access Monitoring -->
2
<rule id="300070" level="11">
3
  <if_sid>300020</if_sid>
4
  <field name="win.eventdata.objectName" type="pcre2">employee|personnel|compensation|performance</field>
5
  <field name="data.department">^(?!HR|Executive)$</field>
6
  <description>Insider Threat: Unauthorized HR data access</description>
7
  <group>insider_threat,privacy_violation</group>
8
</rule>
9

10
<!-- Mass Employee Record Access -->
11
<rule id="300071" level="13" frequency="20" timeframe="600">
12
  <if_sid>300070</if_sid>
13
  <same_field>win.eventdata.subjectUserName</same_field>
14
  <description>Insider Threat: Mass employee record access detected</description>
15
  <group>insider_threat,data_harvesting</group>
16
</rule>

1
# Integration with HR systems for context
2
class EmployeeContextEnricher:
3
    def __init__(self, hr_api_client):
4
        self.hr_client = hr_api_client
5
        self.risk_modifiers = {
6
            'resignation_announced': 3.0,
7
            'performance_review_negative': 2.0,
8
            'recent_privilege_change': 1.5,
9
            'contractor': 1.8,
10
            'new_employee': 1.2
11
        }
12

13
    def enrich_alert(self, alert):
14
        """Add employee context to insider threat alerts"""
15
        user = alert['data']['srcuser']
16
        employee_data = self.hr_client.get_employee(user)
17

18
        risk_multiplier = 1.0
19
        context_flags = []
20

21
        # Check resignation status
22
        if employee_data.get('resignation_date'):
23
            days_until_departure = (
24
                employee_data['resignation_date'] - datetime.now()
25
            ).days
26
            if 0 < days_until_departure < 30:
27
                risk_multiplier *= self.risk_modifiers['resignation_announced']
28
                context_flags.append('DEPARTING_EMPLOYEE')
29

30
        # Check recent reviews
31
        last_review = employee_data.get('last_performance_review')
32
        if last_review and last_review['rating'] < 3:
33
            risk_multiplier *= self.risk_modifiers['performance_review_negative']
34
            context_flags.append('NEGATIVE_REVIEW')
35

36
        # Apply context to alert
37
        alert['risk_score'] *= risk_multiplier
38
        alert['context_flags'] = context_flags
39
        alert['employee_context'] = {
40
            'department': employee_data.get('department'),
41
            'role': employee_data.get('role'),
42
            'tenure_days': employee_data.get('tenure_days'),
43
            'access_level': employee_data.get('access_level')
44
        }
45

46
        return alert

1
<!-- Legitimate After-Hours Workers -->
2
<rule id="300080" level="0">
3
  <if_matched_rules>300010</if_matched_rules>
4
  <list field="win.eventdata.targetUserName" lookup="match_key">
5
    etc/lists/authorized-after-hours-users
6
  </list>
7
  <description>Whitelisted: Authorized after-hours access</description>
8
  <options>no_log</options>
9
</rule>
10

11
<!-- Known Bulk Operations -->
12
<rule id="300081" level="0">
13
  <if_matched_rules>300021</if_matched_rules>
14
  <field name="win.eventdata.processName" type="pcre2">backup|migration|archive</field>
15
  <description>Whitelisted: Legitimate bulk file operation</description>
16
  <options>no_log</options>
17
</rule>

1
def adjust_baseline_for_role(user, role_profile):
2
    """Adjust anomaly thresholds based on job role"""
3
    role_adjustments = {
4
        'IT_Admin': {
5
            'after_hours_threshold': 5.0,  # Higher tolerance
6
            'system_access_threshold': 10.0,
7
            'privilege_use_threshold': 8.0
8
        },
9
        'Sales': {
10
            'data_download_threshold': 7.0,  # Higher for CRM exports
11
            'weekend_access_threshold': 3.0  # Lower for weekend work
12
        },
13
        'Executive': {
14
            'travel_login_threshold': 8.0,  # Higher for travel
15
            'sensitive_access_threshold': 5.0
16
        }
17
    }
18

19
    return role_adjustments.get(role_profile, {})

1
<!-- Automated Response Configuration -->
2
<ossec_config>
3
  <!-- Low Risk Response -->
4
  <active-response>
5
    <command>email-alert</command>
6
    <location>server</location>
7
    <rules_id>300050</rules_id>
8
  </active-response>
9

10
  <!-- Medium Risk Response -->
11
  <active-response>
12
    <command>increase-monitoring</command>
13
    <location>local</location>
14
    <rules_id>300051</rules_id>
15
    <timeout>86400</timeout>
16
  </active-response>
17

18
  <!-- High Risk Response -->
19
  <active-response>
20
    <command>disable-user-account</command>
21
    <location>local</location>
22
    <rules_id>300052</rules_id>
23
  </active-response>
24

25
  <!-- Critical Risk Response -->
26
  <active-response>
27
    <command>isolate-system</command>
28
    <location>local</location>
29
    <rules_id>300053</rules_id>
30
    <timeout>0</timeout>
31
  </active-response>
32
</ossec_config>

1
# Automated investigation trigger
2
def initiate_insider_investigation(alert):
3
    """Automatically gather evidence for insider threat cases"""
4
    investigation = {
5
        'case_id': generate_case_id(),
6
        'user': alert['data']['srcuser'],
7
        'risk_score': alert['risk_score'],
8
        'triggered_at': datetime.now(),
9
        'evidence_collection': []
10
    }
11

12
    # Collect user activity logs
13
    investigation['evidence_collection'].append(
14
        collect_user_logs(investigation['user'], days=30)
15
    )
16

17
    # Capture current system state
18
    investigation['evidence_collection'].append(
19
        capture_endpoint_state(alert['agent']['name'])
20
    )
21

22
    # Preserve network connections
23
    investigation['evidence_collection'].append(
24
        preserve_network_state(alert['agent']['ip'])
25
    )
26

27
    # Create ticket in case management
28
    create_investigation_ticket(investigation)
29

30
    return investigation

1
{
2
  "insider_threat_metrics": {
3
    "alerts_generated": 3421,
4
    "true_positives": 127,
5
    "false_positives": 89,
6
    "prevented_incidents": 23,
7
    "avg_detection_time": "3.2 hours",
8
    "avg_investigation_time": "8.7 hours",
9
    "cost_savings": "$4.7M",
10
    "data_loss_prevented": "847GB",
11
    "accuracy_metrics": {
12
      "precision": 0.588,
13
      "recall": 0.964,
14
      "f1_score": 0.73
15
    }
16
  }
17
}

1
# Anonymization for privacy compliance
2
def anonymize_behavioral_data(user_data):
3
    """Anonymize user data while preserving patterns"""
4
    # Hash user identifiers
5
    user_data['user_hash'] = hashlib.sha256(
6
        user_data['username'].encode()
7
    ).hexdigest()[:16]
8

9
    # Generalize sensitive fields
10
    user_data['department'] = generalize_department(user_data['department'])
11
    user_data['salary_band'] = categorize_salary(user_data['salary'])
12

13
    # Remove PII
14
    pii_fields = ['ssn', 'home_address', 'personal_email']
15
    for field in pii_fields:
16
        user_data.pop(field, None)
17

18
    return user_data

1
# Adaptive baseline adjustment
2
def update_baseline(user, new_activity):
3
    """Update user baseline with new normal activity"""
4
    baseline = load_user_baseline(user)
5

6
    # Exponential moving average for smooth updates
7
    alpha = 0.1  # Learning rate
8
    for metric, value in new_activity.items():
9
        if metric in baseline:
10
            baseline[metric] = (
11
                alpha * value + (1 - alpha) * baseline[metric]
12
            )
13
        else:
14
            baseline[metric] = value
15

16
    # Adjust for seasonal patterns
17
    baseline = apply_seasonal_adjustment(baseline, datetime.now())
18

19
    save_user_baseline(user, baseline)
20
    return baseline