Controlled Software Inventory Management

A subject installs software onto an organization-managed system without prior approval or outside sanctioned methods (e.g., centralized package management, internal software portals). This behavior spans a spectrum of risk - from seemingly benign installations (e.g., video games, personal browsers, media players) to unauthorized deployment of potentially harmful tools sourced from unvetted repositories or adversarial infrastructure.

The infringement may involve:

• Manual download and execution of installer packages
• Use of administrative access to bypass endpoint restrictions
• Cloning or compiling code from external code repositories such as GitHub

While some installations may appear harmless, unapproved software installs can represent a breakdown in configuration control and acceptable use. In high-risk scenarios, such software may introduce remote access mechanisms, data exfiltration capabilities, or other malware. Even benign cases signal behavioral drift, particularly when repeated or ignored, and can contribute to software sprawl, policy erosion, or eventual exploitation.

Exfiltration via automated transcription refers to the capture and conversion of spoken information into structured, persistent data through the use of transcription technologies, including AI-enabled note-taking tools, meeting assistants, and speech-to-text systems.

Unlike traditional media capture techniques, this behavior does not merely reproduce information, it transforms ephemeral verbal communication into searchable, shareable, and analyzable content. This significantly increases the utility and scalability of exfiltrated data, enabling subjects to accumulate large volumes of sensitive information over time with minimal manual effort.

This technique may occur using external tools operating outside organizational control or through misuse of approved or embedded transcription capabilities within enterprise platforms. As a result, it spans both out-of-band and in-band exfiltration paths, making it distinct from media capture behaviors.

In addition to software-based transcription tools, subjects may leverage dedicated or repurposed hardware to capture audio streams for later transcription or processing. This includes the use of intermediary devices capable of intercepting microphone input or headphone output, such as inline audio capture adapters, modified peripherals, or secondary recording devices connected to audio interfaces.

These methods enable the subject to capture high-quality audio directly from system inputs or outputs without relying on visible applications or introducing detectable software artifacts. In such cases, audio may be recorded covertly and later processed through transcription tools outside the organizational environment, further separating the point of capture from the point of transformation and exfiltration.

Exfiltration via automated transcription is particularly effective in environments where sensitive information is frequently communicated verbally, including strategic discussions, incident response, legal proceedings, and technical collaboration. The presence of this behavior may indicate deliberate collection of high-value conversational intelligence, especially where transcription outputs are retained, aggregated, or transferred beyond approved boundaries.

From an investigative perspective, this technique introduces a shift from event-based capture to continuous collection, where subjects build structured datasets over time. Detection therefore relies on identifying tool usage, data flows, and the presence of generated artifacts, rather than isolated capture events.

The subject installs or enables software, scripts, or hardware devices designed to prevent systems from automatically locking, logging out, or entering sleep mode. This unauthorized action deliberately subverts security controls intended to protect unattended systems from unauthorized access.

Characteristics

• Circumvents policies enforcing session locks, idle timeouts, and mandatory logout periods.
• May involve third-party applications ("caffeine" tools), anti-idle scripts, or physical devices such as USB mouse jigglers.
• Typically deployed without organizational approval or awareness.
• Leaves systems continuously unlocked and accessible, undermining endpoint security and physical safeguards.
• Renders full disk encryption protections ineffective while the system remains powered and unlocked.
• Creates opportunities for unauthorized access, data exfiltration, or device compromise by malicious insiders or third parties.

Example Scenario

A subject installs unauthorized anti-sleep software on a corporate laptop to prevent automatic locking during idle periods. As a result, the device remains accessible even when left unattended in unsecured environments such as cafes, airports, or shared workspaces. This action bypasses mandatory screen-lock policies and renders full disk encryption protections ineffective, exposing sensitive organizational data to theft or compromise by malicious third parties who can physically access the unattended device.

A subject installs software that is not considered appropriate by the organization.

The subject installs browser extensions on a managed device that have not been approved, vetted, or distributed via sanctioned organizational channels. These may include productivity tools, automation agents, data scrapers, content manipulators, or AI-enhanced interfaces. Installations typically originate from GitHub repositories, private developer sites, shared file storage, or sideloading tools that bypass enterprise browser controls.

Unapproved extensions introduce unmonitored execution environments directly into the subject’s browser, enabling silent access to sensitive web applications, stored credentials, and internal content. Many request expansive permissions (e.g., webRequest, cookies, tabs, clipboardRead) and operate with persistent background scripts that are difficult to detect through normal endpoint monitoring.

This behavior violates Acceptable Use Policies and, depending on the extension’s behavior, may also constitute unauthorized access, data exfiltration, or malware introduction. Some extensions—particularly those hosted on GitHub or distributed through Telegram groups or developer forums—have been found to contain obfuscated payloads, embedded credential harvesters, or cryptojacking modules.

Examples include:

• Installing a GitHub-hosted ChatGPT sidebar extension that silently logs visited URLs and API keys used in developer consoles.
• Deploying a YouTube downloader that injects scripts for ad click fraud or SEO manipulation.
• Using a browser extension to auto-fill forms with personal data, which transmits data to offshore analytics servers.
• Loading unpacked or custom extensions that disguise themselves as utilities but include base64-encoded malware installers.

While subjects may initially claim curiosity or productivity needs, repeated installation of unapproved extensions—especially after prior enforcement—may indicate normalization of risky behavior or active circumvention of controls.

The subject installs and operates unauthorized cryptocurrency mining software on organizational systems, leveraging compute, network, and energy resources for personal financial gain. This activity subverts authorized system use policies, degrades operational performance, increases attack surface, and introduces external control risks.

Characteristics

• Deploys CPU-intensive or GPU-intensive processes (e.g., xmrig, ethminer, phoenixminer, nicehash) on endpoints, servers, or cloud infrastructure without approval.
• May use containerized deployments (Docker), low-footprint mining scripts, browser-based JavaScript miners, or stealth binaries disguised as legitimate processes.
• Often configured to throttle resource usage during business hours to evade human and telemetry detection.
• Establishes persistent outbound network connections to mining pools (e.g., via Stratum mining protocol over TCP/SSL).
• Frequently disables system security features (e.g., Anti-Virus (AV)/Endpoint Detection & Response (EDR) agents, power-saving modes) to maintain uninterrupted mining sessions.
• Represents not only misuse of resources but also creates unauthorized outbound communication channels that bypass standard network controls.

Example Scenario

A subject installs a customized xmrig Monero mining binary onto under-monitored R&D servers by side-loading it via a USB device. The miner operates in "stealth mode," hiding its process name within legitimate system services and throttling CPU usage to 60% during business hours. Off-peak hours show 95% CPU utilization with persistent outbound TCP traffic to an external mining pool over a non-standard port. The mining operation remains active for six months, leading to significant compute degradation, unplanned electricity costs, and unmonitored external network connections that could facilitate broader compromise.

A subject installs software that is not inherently malicious, but is not wanted, commonly known as “greyware” or “potentially unwanted programs”.