Insider Threat TTP Knowledge Base v2.0.0

The Insider Threat Knowledge Base is created and maintained by the MITRE Engenuity Center for Threat-Informed Defense. The Knowledge Base is an emergent resource that aims to advance our collective understanding of the technical mechanisms that insider threat actors use. This website documents the tactics, techniques, and procedures discovered by organizations who contributed data to this research project.

Contents

• Introduction
  • Project Goal
  • Why ATT&CK
  • Scoping the Insider Threat TTP Knowledge Base
  • Method and Design
• Knowledge Base
  • Green = Seen: Insider Tactics, Techniques, and Procedures
  • Data Collection
• Case Analysis
  • Frequency Heatmap
  • Evidence-Based Inferences
  • Fraud
  • Exfiltration
  • V1 vs V2
  • Limitations
• Identifying and Mitigating Threats
  • Mitigations
  • Data Sources
• Observable Human Indicators
• Portal User Guide
  • Creating a Case
  • Entering TTPs
  • Exporting TTPs
  • Getting Help
  • Password Changes
• Definitions
• Future Work
  • Case Collection
  • Additional OHIs
• Acknowledgements
• Other Center Projects

Notice

© 2024 MITRE Engenuity. Approved for public release. Document numbers CT0041, CT0102.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This project makes use of MITRE ATT&CK®: ATT&CK® Terms of Use