SQ-DL-01Level 3 · Sequence3 steps in 30 days
Quiet exit
- 3 steps
- 30 days
- Level 3 · Sequence
A person enters a notice period or role change, downloads data in bulk above their own baseline, and moves it to personal cloud storage or USB, all within 30 days.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Reconnaissance
- Collection
- Exfiltration
- NIST CSF 2.0 (from its signals)
-
- GV.RR-04
- DE.CM-03
- PR.DS-01
- MITRE ATT&CK (from its signals)
-
- T1530
- T1567.002
The sequence, step by step
SQ-DL-013 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Reconnaissance
Notice or role change
DH-A-02In a notice period or role change
Stage 1Exposed
Step 02ATT&CK tactic: Collection
Bulk download above baseline
DH-B-01Downloads data in bulk above own baseline
Stage 3Exploited
Step 03ATT&CK tactic: Exfiltration
Personal cloud or USB
DH-B-08Stores work data in personal cloud
Stage 4Suspected
Quiet exit, 3 steps inside 30 days: Notice or role change (DH-A-02 In a notice period or role change, Reconnaissance, Stage 1 Exposed); then Bulk download above baseline (DH-B-01 Downloads data in bulk above own baseline, Collection, Stage 3 Exploited); then Personal cloud or USB (DH-B-08 Stores work data in personal cloud, Exfiltration, Stage 4 Suspected). It leads to HB-07 Insider & privilege misuse.
A completed sequence is evidence that its steps happened in order inside 30 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The HR event places the person at Stage 1, the download moves them to Stage 3, and the transfer completes the sequence at Stage 4.
Example
An account executive gave notice on the 3rd, pulled every customer contract from the document system over the next week, and synced the folder to a personal cloud drive.
The steps
3 steps, in order.
-
Notice or role change
-
Bulk download above baseline
-
Personal cloud or USB
How it is measured
- Steps
- 3
- Window
- 30 days
- Sources
- HR system, Web, CASB & DLP
- Breach scenario
- Insider & privilege misuse
How it is used
Programs watch the 3 steps in order inside 30 days; a completed run moves the person to Stage 4 Suspected and points at Insider & privilege misuse.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Quiet exit" (SQ-DL-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-dl-01-quiet-exit
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
Same breach scenario
One other sequence ends in Insider & privilege misuse.
HB-07 Insider & privilege misuse: every sequence, cohort and signal that points to it.
-
SQ-PRV-014 steps · 14 days
Dormant to dangerous
- Step 1: Unused privilege (IA-A-03 Privileges unused for 90+ days)
- Step 2: Unusual login (IA-B-04 Signs in from unusual contexts)
- Step 3: New cloud role (IA-A-02 Member of privileged security groups)
- Step 4: Bulk access (DH-B-01 Downloads data in bulk above own baseline)
- Breach scenario: HB-07 Insider & privilege misuse
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.