Managerial Approval

A subject may make a request for software (such as an RDP, SSH or FTP client) or access (such as USB mass storage device access) to be installed or enabled on a target system, to facilitate the infringement.

The subject creates, modifies, or misuses digital identities within internal communication or collaboration environments—such as email, chat platforms (e.g., Slack, Microsoft Teams), or shared document spaces—to impersonate trusted individuals or roles. This tactic is used to gain access, issue instructions, extract sensitive data, or manipulate workflows under the guise of legitimacy.

Impersonation in this context can be achieved through:

• Lookalike email addresses (e.g., spoofed domains or typo squatting).
• Cloned display names in collaboration tools.
• Shared calendar invites or chats initiated under false authority.
• Use of compromised or unused accounts from real employees, contractors, or vendors.

The impersonation may be part of early-stage insider coordination, privilege escalation attempts, or subtle reconnaissance designed to map workflows, bypass controls, or test detection thresholds.

Example Scenarios:

• A subject registers a secondary internal email alias (john.smyth@corp-secure.com) closely resembling a senior executive and uses it to request financial data from junior employees.
• A subject joins a sensitive Slack channel using a display name that mimics another department member and quietly monitors ongoing discussions related to mergers and acquisitions activity.
• A compromised service account is used by an insider to initiate SharePoint document shares with external parties, appearing as a legitimate internal action.
• The subject impersonates an IT support contact via Teams or email to socially engineer MFA tokens or password resets.

The subject uses a virtual machine (VM) on an organization device to contain artifacts of forensic value within the virtualized environment, preventing them from being written to the host file system. This strategy helps to obscure evidence and complicate forensic investigations.
 

By running a guest operating system within a VM, the subject can potentially evade detection by security agents installed on the host operating system, as these agents may not have visibility into activities occurring within the VM. This adds an additional layer of complexity to forensic analysis, making it more challenging to detect and attribute malicious activities.

The subject purchases a laptop (or similar endpoint) using a corporate payment method but does so outside established procurement and provisioning processes. By bypassing IT and asset management workflows, the subject introduces a corporate-funded but unmanaged device into the environment.

Such devices often lack standard security controls—such as endpoint detection and response (EDR), encryption, configuration baselines, or patching—and may not be tracked in asset inventory systems. While the subject may rationalize the purchase as operationally necessary (e.g., urgency, convenience, or perceived lack of IT responsiveness), the result is a sanctioned but invisible device with the potential to bypass monitoring and governance controls.

This behavior undermines organizational asset control, complicates investigative attribution, and introduces unmanaged endpoints capable of accessing sensitive networks and data.

The subject deliberately impersonates a member of the organization—typically a colleague, manager, or IT representative—or otherwise misrepresents themselves in order to manipulate service desk staff into resetting a password, unlocking an account, or granting access to a system. These requests are framed to appear legitimate and urgent, often exploiting common support workflows or pressure tactics (e.g., deadline stress, executive impersonation).

This behavior is especially dangerous because it abuses internal trust pathways and bypasses traditional authentication, detection, or technical controls. It can occur via phone, email, chat, or in-person interaction and is frequently used in preparation for unauthorized data access, surveillance, or exfiltration.