Insider Threat: Hunting and Detecting | Mandiant

https://www.mandiant.com/resources/blog/insider-threat-hunting-detecting