User behavior analytics (UBA) has been a hot topic in IT security for some time now. With successful deployment of perimeter defense, companies must now address the threat within. This threat, whether from a rogue employee, careless business partner or external actor with compromised credentials, is real and often difficult to detect.

The effects of this threat can be devastating for a company, either in loss of intellectual property, a drop in customer confidence or damage to its brand and reputation. For example, the attack on the electrical grid in Ukraine and the resulting blackout for over 200,000 customers all started with an infected Word document being opened by an insider.

QRadar UBA App Reveals Anomalous Activities

To counter this threat, clients are increasingly adopting UBA solutions. In fact. the IBM QRadar UBA app is the most popular platform on the IBM Security App Exchange. With over 4,000 downloads, clients are deploying this app to identify and detect anomalous activities among their users.

Our clients reported many interesting behavior patterns they detected using QRadar UBA, including:

  • User admins changing other people’s attributes without proper permissions;
  • Users sharing virtual private network (VPN) credentials;
  • Devices being taken out of the country when users are on vacation;
  • Contractors in North America checking messages and emails in cloud services and then the same accounts being accessed from abroad within minutes;
  • Security operations center (SOC) analyst accounts infected with malware;
  • Detected misconfiguration of other security tools;
  • Users opening personal accounts on servers; and
  • A higher-than-expected number of logins from machine accounts.

Rules Were Made to Be Broken

Until relatively recently, security software relied on rules-based analytics to detect anomalies and bring them to the attention of SOC analysts. Rules are great because they are clear, precise and can easily be written and implemented, but they have their limitations.

For one, they can generate a lot of false positives. More importantly, you can only write a rule for a threat that is known or an attack pattern that can be predicted. What do you do when a new threat emerges? You are essentially unprotected until the threat becomes known.

Monitoring User Behavior With Machine Learning

This is where machine learning can help. It can understand the normal behavior of a user and can identify meaningful deviations. The upcoming release of IBM QRadar UBA (version 2.0) includes machine learning algorithms to detect anomalous activities and suspicious behavior.

These machine learning algorithms will detect temporal or time series anomalies. They monitor users across multiple dimensions and create a model for normal pattern of activities, asset usage and network communications. These individual user models can then be leveraged to determine when a user begins to do something new. The algorithms detect and flag the anomalous activity, triggering the UBA app to raise the risk score of the users or raise an offense when appropriate.

Reducing False Positives

By monitoring each user activity, the tool can identify any roles that individual has within the organization and assign people into role-based peer groups. New behaviors that deviate from these roles can be detected and may be early indicators of malicious intent.

The algorithms work independently and examine users’ activities from several perspectives to reduce the number of false positives. They address a broad range of use cases, including:

  • Change in users’ activity without change in associated frequency;
  • Change in frequency of activity without any change in the activity itself;
  • Change in the time window of user activity;
  • Slow encroachment of data over a long period; and
  • Data exfiltration from a device or through the network.

Strengthening the SOC

Version 2.0 of IBM QRadar UBA will enable SOC analysts to:

  • Improve threat detection by using built-in machine learning algorithms that continually adjust and tune to each user’s normal behavior.
  • Improve SOC operations by reducing offense fatigue while boosting efficient detection and investigation of suspicious activities.
  • Present real-time insights into the risk posture of the monitored users and environment.

With the security intelligence and threat detection capabilities of QRadar UBA, IT professionals are better equipped to keep pace with malicious insiders, external fraudsters and the ever-evolving cybercrime landscape.

Learn More About User Behavior Analytics and download the UBA App

More from Intelligence & Analytics

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. X-Force has observed nearly two dozen email campaigns since late June leveraging the updated DBatLoader loader to deliver payloads such as Remcos, Warzone, Formbook, and AgentTesla. DBatLoader malware has been used since 2020 by cybercriminals to install commodity malware remote access Trojans (RATs) and infostealers, primarily via malicious spam (malspam). DBatLoader…

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Unmasking hypnotized AI: The hidden risks of large language models

11 min read - The emergence of Large Language Models (LLMs) is redefining how cybersecurity teams and cybercriminals operate. As security teams leverage the capabilities of generative AI to bring more simplicity and speed into their operations, it's important we recognize that cybercriminals are seeking the same benefits. LLMs are a new type of attack surface poised to make certain types of attacks easier, more cost-effective, and even more persistent. In a bid to explore security risks posed by these innovations, we attempted to…