Baseline System Performance Profiling

Establish and monitor baseline system performance metrics for all critical endpoints, servers, and cloud workloads to detect deviations that may indicate unauthorized activities, such as crypto mining, data staging, or malware execution. Deviations from expected resource usage profiles can serve as an early indicator of operational misuse, compromise, or unauthorized software deployment.

Detection Methods

• Collect and baseline key performance metrics (e.g., CPU utilization, GPU load, memory consumption, disk I/O, and network throughput) for each system class based on normal operational workloads.
• Continuously monitor and analyze live system telemetry against established baselines using security information and event management (SIEM), endpoint detection and response (EDR), or cloud-native monitoring tools.
• Set threshold alerts for resource utilization that significantly exceeds normal variance ranges over sustained periods without corresponding change tickets, scheduled tasks, or workload justifications.
• Correlate performance anomalies with process monitoring to identify unauthorized or unexpected processes consuming system resources.
• Integrate anomalous performance detections into insider threat investigation workflows, focusing on unexplained deviations, especially on systems not expected to experience significant workload fluctuations (e.g., office endpoints, file servers, idle cloud instances).

Indicators

• Sustained CPU or GPU utilization significantly above baseline norms, particularly during non-peak operational hours.
• Persistent high memory usage, disk I/O, or network traffic inconsistent with documented business activities.
• Systems exhibiting performance profiles typical of known unauthorized activities (e.g., high sustained CPU with low disk I/O suggestive of mining workloads).
• Lack of approved change requests or business justification corresponding with the onset of anomalous resource usage.
• Anomalies clustered around users, departments, or system groups known for prior boundary-testing or policy violations.