Insider or Intrusion? Adjudicating a 1.2 GB Upload Under a 24-Hour Deadline
You are the CTI lead at a mid-sized health insurer with 4,200 employees. On a Tuesday morning the DLP platform flags a 1.2 GB upload of member eligibility extracts from a claims analyst's laptop to a personal Google Drive account. EDR shows the same laptop has been running a signed ScreenConnect client installed nine days earlier; the analyst says she was on annual leave that week and installed nothing. Her credentials authenticated from a residential Nigerian IP 36 hours before the upload, then again from the office the following morning. The CISO wants an answer in 24 hours: insider or external? A vendor report on your desk claims a ransomware affiliate buys access from initial access brokers and resells it to insurers. One analyst argues "insider - she had a poor performance review last month." A second says the Nigerian IP settles it. Neither has written anything down.
1. Enumerate the competing hypotheses you would score, and explain what an ACH-style inconsistency matrix would likely show here.
Read the worked answer
Build the matrix before arguing. Candidate hypotheses:
- H1 - Witting insider: the analyst exfiltrated data herself.
- H2 - Unwitting insider: her account and machine were used, but she had no knowledge.
- H3 - External actor on her endpoint: stolen credentials plus a remote-management tool installed on her laptop, which acted as the staging host.
- H4 - External actor, endpoint incidental: the upload left the corporate tenant from attacker infrastructure and the laptop is a red herring.
- H5 - Broker-to-affiliate chain: an initial access broker sold access, the affiliate installed ScreenConnect, and the analyst's own return to the office caused the DLP alert to fire on her session.
Score each item of evidence as consistent, inconsistent, or not applicable - not as "supports." The Nigerian authentication is consistent with H3 and H5 and also with H1 (an insider can use a proxy), so it has low diagnostic value. The on-leave timing is strongly inconsistent with H1 only if the install window falls inside the leave dates - that is a factual gap, not a conclusion. The DLP endpoint context ties the upload to her device, weakening H4. ScreenConnect presence is neutral until you know whether it is the sanctioned MSP build; many enterprises already run it, which would make it a base-rate artifact rather than attacker tooling.
The performance-review motive is not evidence. It is an unverified narrative that makes H1 feel plausible, and treating it as data is the classic failure mode ACH is designed to prevent. The vendor report is also not evidence about this case; it is a base rate at best.
ACH does not produce probabilities. It ranks hypotheses by fewest inconsistencies and tells you where the matrix is thin. Here the likely result is H3/H5 leading with a large unresolved gap: who installed the tool and under what logon context.
2. Rank the next-24-hour collection by diagnostic value and explain why each item discriminates.
Read the worked answer
Prioritize evidence that splits hypotheses rather than evidence that merely fits one.
- ScreenConnect installer forensics. Parent process, user context (interactive vs SYSTEM), MSI source path, binary hash, and whether the build matches the licensed MSP package. An install under her interactive session during leave points hard at H1 or H2/H3 with credential misuse; an install by SYSTEM from a temp path points at H3/H5.
- Identity provider logs for the Nigerian sign-in. Was MFA satisfied and how (push, token, session cookie replay)? Which client app? A successful token replay with no MFA prompt supports session theft and H3, and explains why a second sign-in from the office succeeded afterwards.
- The Drive-side record. Which account authenticated, from which device and browser profile, and whether the upload was user-initiated at the endpoint or a browser session carrying a stolen token. This separates H3 from H4.
- Presence records. Badge, VPN, and leave-calendar timestamps to establish whether the analyst could physically have acted.
- Forensic image of the laptop before any rebuild, plus EDR process ancestry for the days around the install.
Low-value items to deprioritize: geoIP alone (VPN and proxy traffic is routine), a motive interview, and vendor sector reporting. Also flag a collection risk: if the analyst is complicit, interviewing her first tips off the actor; if she is a victim, a heavy-handed interview destroys cooperation. Sequence the technical collection first.
3. Draft the 24-hour bottom line with explicit confidence language, and state what you will refuse to assert.
Read the worked answer
A defensible interim product looks like this:
Assessment (interim, 24h): We assess with moderate confidence that an external party used credentials belonging to a claims analyst, together with a remote-management client present on her laptop, to stage and upload member eligibility data. We cannot exclude witting insider involvement, and we cannot yet establish who installed the remote-management client. Identity of the operator and the destination buyer are unknown.
Justify the confidence level: two independent evidence streams agree (endpoint telemetry and identity provider logs), but the single most diagnostic fact - installer attribution - is missing, and one stream depends on unverified endpoint context.
Refuse to assert, explicitly and in writing:
- That the Nigerian IP identifies the actor's location or nationality. It is infrastructure, not a person.
- That the actor matches the cluster in the vendor report. Sector targeting is a base rate, not a link.
- That the analyst is culpable or exonerated. Both statements would be premature and one is defamatory.
- Any estimate of how much data a third party now holds.
Then attach a re-look trigger list: instalment attribution resolved, IdP token replay confirmed or excluded, or Drive-side record obtained. Say plainly that the 24-hour deadline is a decision-support constraint, not an analytical one - the CISO gets a decision-grade interim answer plus named gaps, not a fabricated certainty. Recommend containment actions that are safe under every hypothesis: revoke sessions and refresh tokens, isolate the laptop, force MFA re-registration, and audit all Drive uploads for the preceding 30 days.