Departing Employee Data Exfiltration: User_1 Transfers Corporate Design Files to Personal Accounts

Initial Signal

On May 15, 2026 at 02:53 UTC, a SharePoint folder named '[SHARE_FOLDER_1]' was shared with the personal Gmail account user_1_personal@gmail.com, triggering an "Unusual Volume of External File Sharing" alert in Microsoft Defender XDR. The user, identified as user_1@[INTERNAL_DOMAIN_1].com, holds the role of Senior Design Associate - Architecture based in [CITY_4], IL. The alert alone might suggest account compromise, but the broader context tells a different story. Over the preceding three days (May 12–15), the user engaged in a coordinated pattern of data movement to personal infrastructure: forwarding a 4.4MB email containing HR separation documents to personal Gmail on May 13, sending farewell emails with attachments to external clients, creating a guest account for the personal Gmail address in the corporate Entra tenant on May 15, and mounting an external LaCie USB drive twice within minutes of the SharePoint sharing event. All authentication activity originated from Illinois-based residential ISP addresses (AT&T and Comcast) consistent with the user's home location—no geographic anomalies, no impossible travel, no credential theft indicators. The investigation spanned 3 days and correlated email logs, SharePoint audit events, Entra ID directory audits, endpoint telemetry, and sign-in logs across Microsoft 365 Defender, Microsoft Entra, and Microsoft Defender for Endpoint, revealing a coherent insider data exfiltration narrative rather than an external compromise.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. FP-1
   Evaluate whether email forwarding to personal Gmail could be routine/benign behavior.
   Fail
2. FP-2
   Evaluate whether SharePoint folder sharing to personal Gmail could be routine/benign.
   Fail
3. FP-3
   Evaluate whether guest account creation for personal Gmail could be routine/benign.
   Fail
4. FP-5
   Evaluate whether external account compromise could explain the observed activity.
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious Insider Activity at medium confidence rests on the following mutually corroborating signals:

1. Multiple independent exfiltration vectors all targeting the same personal Gmail account (email forwarding, SharePoint folder sharing, guest account creation) within a 3-day window, demonstrating coordinated intent rather than isolated policy violations

2. The targeted data—SharePoint folder '[SHARE_FOLDER_1]'—directly aligns with the user's job function as Senior Design Associate - Architecture, indicating the user knew the value and sensitivity of the intellectual property being transferred

3. Guest account creation for user_1_personal@gmail.com in the corporate Entra tenant at 02:53:08Z on May 15 specifically enables persistent post-employment access to corporate resources, demonstrating intent to circumvent natural access termination upon separation

4. All sign-in activity originated from consistent Illinois residential ISP addresses (AT&T [CITY_1]/[CITY_2], Comcast [CITY_4]) with no geographic anomalies, no HIBP breach records, no risky sign-in events, and no MFA method removals—ruling out external account compromise and confirming the legitimate account holder is the actor

5. Email subjects across the period ('Exit Survey and Separation Information,' 'Son's departure,' 'Adios Por Ahora!') establish active offboarding context, and Safe Links telemetry confirms the user clicked HR employment separation pages on May 13, corroborating knowledge of imminent departure. Confidence is Moderate rather than High because: (a) no file write events to the USB drive were captured, preventing confirmation of actual data transfer to removable media; (b) file-level detail on the SharePoint folder share is unavailable, preventing full quantification of exfiltration scope; and (c) attachment content in emails to external clients is unknown, leaving open the possibility that some correspondence was legitimate farewell communication rather than data theft

Lessons

1. 01
   Offboarding windows are high-risk periods for insider data theft. In this investigation, the user's data exfiltration occurred entirely within a 3-day offboarding period (May 12–15). The user had already engaged with HR separation content (clicked employment separation pages on May 13) and sent farewell emails to colleagues and external clients. Organizations should implement heightened monitoring and access controls during active employee separation: flag all external file sharing, email forwarding, and guest account creation during the offboarding window; require manager approval for any SharePoint sharing to external addresses; and disable USB device mounting on endpoints of departing employees. The window between notification of departure and actual separation is when insiders are most motivated to exfiltrate data.
2. 02
   Multiple exfiltration vectors targeting the same external account signal coordinated intent. This investigation identified four independent exfiltration vectors—email forwarding, SharePoint sharing, guest account creation, and USB mounting—all within 3 days and all involving the same personal Gmail account (user_1_personal@gmail.com). A single policy violation (e.g., one email to personal Gmail) might be benign; the convergence of multiple vectors is a strong indicator of deliberate data theft. Detection systems should correlate across email, cloud storage, identity, and endpoint logs to identify this pattern. A single email forward might be missed; a guest account creation might be missed; but the combination of both targeting the same external address within hours should trigger escalation.
3. 03
   Guest account creation for personal email is a persistence mechanism, not a collaboration tool. The user created a guest account for user_1_personal@gmail.com in the corporate Entra tenant at 02:53:08Z on May 15—the same minute as the SharePoint folder share. This is not a standard collaboration pattern. Guest accounts are typically created by IT administrators for external partners or consultants with business justification. When a user creates a guest account for their own personal email address, especially during offboarding, the intent is to maintain post-employment access to corporate resources. Audit logs should flag any guest account creation initiated by non-admin users, and especially flag creation of guest accounts for personal email domains. Require manager or IT approval before any guest account creation.
4. 04
   Role-data alignment is a key indicator of insider intent. The user's role was Senior Design Associate - Architecture, and the targeted SharePoint folder was '[SHARE_FOLDER_1]'—directly relevant to architecture work. An external threat actor compromising this account would likely exfiltrate data at random or based on sensitivity labels; an insider knows which data is valuable to their role and to their next employer. When investigating data exfiltration, cross-reference the user's job title and department against the data being shared. If a departing employee is exfiltrating data that directly aligns with their core job function, the likelihood of insider intent increases significantly.
5. 05
   Absence of geographic anomalies does not rule out insider threats. All sign-in activity in this investigation originated from Illinois residential ISP addresses consistent with the user's home location. There were no impossible travel events, no foreign IPs, no VPN indicators. This ruled out external account compromise but did not rule out insider activity. Insider threats often originate from the user's home or office—the same locations where legitimate activity occurs. Do not assume that consistent geolocation and ISP patterns indicate benign activity. Instead, correlate geolocation with other signals: email forwarding, file sharing, guest account creation, and USB mounting. An insider working from home during offboarding is still an insider threat.