Threat chain breakdown
I mapped how the attacker used an account, accessed remote services and ran commands.
Coursework case study · Threat analysis
KnowBe4 Insider Threat Analysis
In this coursework, I analysed the 2024 KnowBe4 insider threat case, focusing on identity theft, deepfakes during hiring and the attempted malware activity that followed.
- Domain
- Insider risk · identity security
- Method
- OSINT · timeline · root cause
- Framework
- MITRE ATT&CK
- Response
- 25-minute incident window analysis
In short
The attacker got through remote hiring checks and then tried to run malware. I traced the gaps between HR and IT processes and recommended stronger identity checks for remote hires, plus endpoint monitoring combined with zero-trust access controls.
01 · Approach
What went wrong with the hiring checks.
I brought together public reports and technical details to review the incident timeline and how the attacker got through the remote hiring process.
- Collect. Gather public reports and technical details of the incident.
- Reconstruct. Build the incident timeline, including the 25-minute response window.
- Map. Map the attacker’s activity to ATT&CK.
- Recommend. Identify the checks and controls that might have helped.
02 · Analysis
The main weaknesses I identified.
Root cause review
I found gaps between the HR and IT processes, including weaknesses in the checks used for remote hires.
03 · ATT&CK mapping
Techniques I mapped.
| Technique | Name | Tactic | In this case |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Used the account issued to the new hire |
| T1133 | External Remote Services | Initial Access | Accessed remote services |
| T1059 | Command and Scripting Interpreter | Execution | Ran commands on the endpoint |
04 · Recommendations
Changes I recommended.
Identity checksStrengthen the checks used for remote hires and the handover between HR and IT.
Monitoring and accessCombine endpoint monitoring with zero-trust controls and ongoing access checks.