Detecting Unauthorized Behavior From Legitimate Accounts

Incident Responders face an almost insurmountable amount of log events, and the move to the Cloud has only intensified this dependency on log data for intrusion analysis.Attackers are shifting techniques to utilize compromised accounts to hide their activity among the volume of legitimate business activity.Security teams struggle to detect and alert to this scenario as the ratio between time-to-discovery and time-to-compromise continues to exhibit a sizeable gap.A new approach is needed to tackle complex alerting using tools available to security teams.This paper defines a new methodology to detect unauthorized access from legitimate accounts.The paper also uses open-source tools to implement this methodology, providing a cost-effective solution available to all security teams.