Attack scenario
Insider threat and authorized access abuse
An insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
Why this scenario matters
The activity may resemble normal user work and may not involve malware or a technical exploit. Identity, permissions, data sensitivity, device, time, volume, and destination context become decisive.
The scenario connects IAM, PAM, UEBA, DLP, data classification, database monitoring, cloud logs, and removable-media controls into one investigable view.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Discovery
- Exfiltration
- Initial Access
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
- T1078 Valid Accounts
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1052 Exfiltration Over Physical Medium
- T1567 Exfiltration Over Web Service
- T1070 Indicator Removal
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.