SQ-PRV-01Level 3 · Sequence4 steps in 14 days
Dormant to dangerous
- 4 steps
- 14 days
- Level 3 · Sequence
A person holds privileges unused for 90 or more days, signs in from an unusual context, gains membership of a privileged cloud group, and downloads data in bulk above their baseline, all within 14 days.
Classification
- Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Reconnaissance
- Initial Access
- Privilege Escalation
- Collection
- NIST CSF 2.0 (from its signals)
-
- PR.AA-05
- DE.CM-03
- MITRE ATT&CK (from its signals)
-
- T1078.004
- T1078
- T1098.003
- T1530
The sequence, step by step
SQ-PRV-014 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Reconnaissance
Unused privilege
IA-A-03Privileges unused for 90+ days
Stage 1Exposed
Step 02ATT&CK tactic: Initial Access
Unusual login
IA-B-04Signs in from unusual contexts
Stage 4Suspected
Step 03ATT&CK tactic: Privilege Escalation
New cloud role
IA-A-02Member of privileged security groups
Stage 4Suspected
Step 04ATT&CK tactic: Collection
Bulk access
DH-B-01Downloads data in bulk above own baseline
Stage 4Suspected
Dormant to dangerous, 4 steps inside 14 days: Unused privilege (IA-A-03 Privileges unused for 90+ days, Reconnaissance, Stage 1 Exposed); then Unusual login (IA-B-04 Signs in from unusual contexts, Initial Access, Stage 4 Suspected); then New cloud role (IA-A-02 Member of privileged security groups, Privilege Escalation, Stage 4 Suspected); then Bulk access (DH-B-01 Downloads data in bulk above own baseline, Collection, Stage 4 Suspected). It leads to HB-07 Insider & privilege misuse.
A completed sequence is evidence that its steps happened in order inside 14 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The dormant privilege keeps the person at Stage 1; the unusual sign-in completes the sequence at Stage 4, and the new role and the bulk access are the escalation and collection that follow.
Example
A dormant service-desk account with old database rights signed in from a new device, was added to a cloud admin group the same day, and exported the customer table that week.
The steps
4 steps, in order.
-
Unused privilege
-
Unusual login
-
New cloud role
How it is measured
- Steps
- 4
- Window
- 14 days
- Sources
- IGA, PAM & entitlements, Identity provider & MFA, Web, CASB & DLP
- Breach scenario
- Insider & privilege misuse
How it is used
Programs watch the 4 steps in order inside 14 days; a completed run moves the person to Stage 4 Suspected and points at Insider & privilege misuse.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Dormant to dangerous" (SQ-PRV-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-prv-01-dormant-to-dangerous
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
Same breach scenario
One other sequence ends in Insider & privilege misuse.
HB-07 Insider & privilege misuse: every sequence, cohort and signal that points to it.
-
SQ-DL-013 steps · 30 days
Quiet exit
- Step 1: Notice or role change (DH-A-02 In a notice period or role change)
- Step 2: Bulk download above baseline (DH-B-01 Downloads data in bulk above own baseline)
- Step 3: Personal cloud or USB (DH-B-08 Stores work data in personal cloud)
- Breach scenario: HB-07 Insider & privilege misuse
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.