Detection of Malicious Privileged Access Using a RuleBased Approach

Privilege insiders are harder to detect by organizations. An organization's systems are subjected to threats that will affect missions, assets, and individuals of the organization. Many organizations affected by threats over a year. This paper modeled the path of actors that aims to publish and share sensitive data of the company such as files to unauthorized users by insider attack by using State Transition Diagram and developed detection of the modeled insider attack paths using the rule-based approach. There are seventy-seven attack steps that can be taken to achieve goals of publishing and sharing sensitive company files which are done by an insider attack. After deep studying of the attacks steps, the designed diagram has layered the attack steps based on analysis and aggregated them to five groups. This paper also uses offline analysis, which use the log file after the attack occurred, publish process is not affected in offline analysis. Rules and pseudocode are explained in detail.