3 ms·

I appreciate the reply. When you say you do this for a living, what do you mean? Is your role to sniff this sort of thing out, a whole company, or part of you

I appreciate the reply. When you say you do this for a living, what do you mean? Is your role to sniff this sort of thing out, a whole company, or part of your job on a team? I agree, none of this is evidence, just intel here. Not sure if we have Defender ATP. We have MDE, which I am starting to dig into now. I don't have direct access, so just looking through pulls after I make a request. For the devs, a simple glance at their gitlab contributions tells you a lot. For remote folks the VPN is another like the logins. The truly lazy won't even bother to be on the VPN, but doesn't mean they are not working. Apparently one of our main sys admins is never on the VPN. It would be nice if some of the enterprise licensed tools gave some metrics like Outlook, intelliJ/VSCode, and Gitlab, all overlaid on a simple bar chart of activity. It would be pretty easy to see gaps and to piece together a work day. I realize that doesn't account for whiteboard time etc, but that stuff is explainable. 3-4 hours per day of activity + very low contributions is not explainable. I don't think we have gone up against a real professional yet. If they are here, they are really good. It's a pretty small team and low output sticks out like a sore thumb.

jstarfish 3y ago
> Is your role to sniff this sort of thing out, a whole company, or part of your job on a team? Internal [cyber]investigations. We branched off from cybersecurity, but there's a sister team that handles traditional cases (anything not involving digital forensics). > We have MDE, which I am starting to dig into now. If you're talking about Defender for Endpoints, that might be the same thing (I can't keep up with Microsoft's product shuffling). There should be a dashboard you/the admin can access at security.microsoft.com, with a cylinder database icon (Advanced Hunting) in the top left corner that lets you run KQL queries like the ones I shared. > For the devs, a simple glance at their gitlab contributions tells you a lot. For remote folks the VPN is another like the logins. The truly lazy won't even bother to be on the VPN, but doesn't mean they are not working. Apparently one of our main sys admins is never on the VPN. Again, kudos for your restraint. Divining truth from ambiguity is not easy. Commit counts can be an inverse metric. Bad devs overinflate their commits ("typo correction lol"), and those diligently trying to iron out bugs and working on genuinely-hard problems will have less code to commit. My own VPN usage is spotty, and I'm remote. I just don't always need to be on it-- I spend a ton of time looking at spreadsheets and logs locally. Email, Slack and OneDrive work when I'm not on the corporate network, so sometimes I don't even notice I'm not connected. Your sysadmin...be careful there. I'm literally seeing the same thing wrt low/no logins of one of ours, but any number of witnesses could confirm he's actively working (attends meetings, available when needed, tasks are completed, etc.). It's just not clear to me how he's doing the job. The nature of that role also makes them a dangerous person to piss off. No one data point means more than any other. It's all a game of how many red flags, in aggregate, does the individual raise? > I don't think we have gone up against a real professional yet. If they are here, they are really good. The single biggest facepalm of my career occurred when I live-demoed this concept to the rest of the team and outed one of our own. I assumed it was a glitch, but others were harboring suspicions they couldn't justify raising until I presented numbers suggesting that the individual wasn't even logging into their computer. Still wasn't enough to take direct action on...but they did not survive the next round of layoffs.
jstarfish 3y ago
Missed the second part of your post: > It would be nice if some of the enterprise licensed tools gave some metrics like Outlook, intelliJ/VSCode, and Gitlab, all overlaid on a simple bar chart of activity. It would be pretty easy to see gaps and to piece together a work day. I realize that doesn't account for whiteboard time etc, but that stuff is explainable. 3-4 hours per day of activity + very low contributions is not explainable. Yeah, they don't make it easy. There are dedicated tools for desktop surveillance but that's too invasive for my tastes. I've been doing this job long enough that I've seen things I wish I hadn't. It's hard to measure "activity" in an app, but with Defender we can check if a process is even running in the first place. I don't have any canned queries for that since I can't anticipate the tools every random employee is going to use. You start looking for VSCode, j'accuse them after not finding it, and they counter with "but I use Pycharm/Eclipse/etc." > 3-4 hours per day of activity + very low contributions is not explainable. Every company is different, but that's pretty typical for ours. Half of everybody's day is meetings, and I don't have any way to easily verify whether a meeting existed or whether they attended, so it's not a standard I would personally hold anybody to. Maybe you're running a sweatshop though, in which case expectations are higher ;) We're both approaching this from a position of disadvantage...it's real easy to be made a fool of when it comes to accusations.

jstarfish 3y ago

> Is your role to sniff this sort of thing out, a whole company, or part of your job on a team? Internal [cyber]investigations. We branched off from cybersecurity, but there's a sister team that handles traditional cases (anything not involving digital forensics). > We have MDE, which I am starting to dig into now. If you're talking about Defender for Endpoints, that might be the same thing (I can't keep up with Microsoft's product shuffling). There should be a dashboard you/the admin can access at security.microsoft.com, with a cylinder database icon (Advanced Hunting) in the top left corner that lets you run KQL queries like the ones I shared. > For the devs, a simple glance at their gitlab contributions tells you a lot. For remote folks the VPN is another like the logins. The truly lazy won't even bother to be on the VPN, but doesn't mean they are not working. Apparently one of our main sys admins is never on the VPN. Again, kudos for your restraint. Divining truth from ambiguity is not easy. Commit counts can be an inverse metric. Bad devs overinflate their commits ("typo correction lol"), and those diligently trying to iron out bugs and working on genuinely-hard problems will have less code to commit. My own VPN usage is spotty, and I'm remote. I just don't always need to be on it-- I spend a ton of time looking at spreadsheets and logs locally. Email, Slack and OneDrive work when I'm not on the corporate network, so sometimes I don't even notice I'm not connected. Your sysadmin...be careful there. I'm literally seeing the same thing wrt low/no logins of one of ours, but any number of witnesses could confirm he's actively working (attends meetings, available when needed, tasks are completed, etc.). It's just not clear to me how he's doing the job. The nature of that role also makes them a dangerous person to piss off. No one data point means more than any other. It's all a game of how many red flags, in aggregate, does the individual raise? > I don't think we have gone up against a real professional yet. If they are here, they are really good. The single biggest facepalm of my career occurred when I live-demoed this concept to the rest of the team and outed one of our own. I assumed it was a glitch, but others were harboring suspicions they couldn't justify raising until I presented numbers suggesting that the individual wasn't even logging into their computer. Still wasn't enough to take direct action on...but they did not survive the next round of layoffs.

jstarfish 3y ago

Missed the second part of your post: > It would be nice if some of the enterprise licensed tools gave some metrics like Outlook, intelliJ/VSCode, and Gitlab, all overlaid on a simple bar chart of activity. It would be pretty easy to see gaps and to piece together a work day. I realize that doesn't account for whiteboard time etc, but that stuff is explainable. 3-4 hours per day of activity + very low contributions is not explainable. Yeah, they don't make it easy. There are dedicated tools for desktop surveillance but that's too invasive for my tastes. I've been doing this job long enough that I've seen things I wish I hadn't. It's hard to measure "activity" in an app, but with Defender we can check if a process is even running in the first place. I don't have any canned queries for that since I can't anticipate the tools every random employee is going to use. You start looking for VSCode, j'accuse them after not finding it, and they counter with "but I use Pycharm/Eclipse/etc." > 3-4 hours per day of activity + very low contributions is not explainable. Every company is different, but that's pretty typical for ours. Half of everybody's day is meetings, and I don't have any way to easily verify whether a meeting existed or whether they attended, so it's not a standard I would personally hold anybody to. Maybe you're running a sweatshop though, in which case expectations are higher ;) We're both approaching this from a position of disadvantage...it's real easy to be made a fool of when it comes to accusations.