How to detect employee termination risk

Threat snapshot

The period between when an employee decides to leave and when their access is revoked is one of the highest-risk windows in enterprise security. The employee has full legitimate access to all systems their role requires, but their incentive to protect the organization's data has changed. Research consistently shows that a significant percentage of employees who resign or are terminated take proprietary information with them: customer lists, source code, financial models, product roadmaps, or whatever the most strategically valuable data in their role happens to be.

What distinguishes a termination-risk data loss event from an external breach is not the technical method but the legitimacy of the access. The employee is not bypassing authentication, exploiting a vulnerability, or using stolen credentials. They are accessing files and systems they are fully authorized to access, which is why traditional security controls that detect anomalous authentication or unauthorized access provide little protection in this scenario. The signal is behavioral: a pattern of access that deviates from the employee's established baseline in volume, scope, or destination.

The behavioral patterns that indicate data collection before departure are well-documented and detectable with the right monitoring in place. Bulk file access that exceeds the employee's normal daily volume, email forwarding rules created to personal accounts, SharePoint mass downloads, connections to cloud storage services like MEGA or Rclone configurations, and PowerShell-based email collection all produce log events that Log360's detection rules surface in real time.

Employee termination risk, at a glance

How termination-related data loss occurs

Data exfiltration by departing employees follows predictable patterns based on the employee's role, technical sophistication, and the type of data they are targeting. Five primary exfiltration paths account for the vast majority of termination-risk incidents.

Email collection and forwarding (T1114)

Email forwarding is the simplest and most common exfiltration method for non-technical departing employees. Creating a mail flow rule in M365 that forwards all incoming and outgoing mail to a personal Gmail or Outlook account requires no technical knowledge and takes under a minute in the M365 web interface. The forwarded copy arrives in the personal account regardless of what happens to the corporate account after termination, creating a persistent copy of all business correspondence, attachments, and customer communications.

More technically capable employees may use PowerShell to perform local email collection, accessing Outlook PST files or Exchange mailboxes via MAPI to extract email archives directly to local disk before external transfer. This approach bypasses M365 forwarding rule monitoring because the collection happens at the local client level rather than via M365 transport rules.

Cloud storage and tunnel exfiltration (T1567.002)

Cloud storage services are the preferred exfiltration destination for departing employees who want to avoid DLP controls monitoring USB or email. MEGA, Ufile, and similar services provide encrypted file storage with no corporate visibility into uploaded content. Rclone is a command-line tool that syncs files to over 70 cloud storage backends and is particularly effective for bulk exfiltration because it can replicate entire directory trees in a single command. Tunneling tools like Ngrok, Cloudflared, BTunnels, DevTunnels, and VS Code tunnels create encrypted channels to external endpoints that can bypass DLP and web filtering by routing through legitimate hosting infrastructure.

Mass file access and SharePoint download (T1005)

Data hoarding before departure typically shows up as a sudden increase in file access volume on file servers and SharePoint. An employee who normally accesses 50 to 100 files per day suddenly reading 2,000 files in a single session is collecting data, not doing their job. Failed file access attempts are equally significant: an employee probing restricted directories indicates they are testing the boundaries of their access to find additional data beyond their normal role scope. In M365 environments, bulk SharePoint downloads above a defined daily threshold are the primary data collection indicator for cloud-native departing employees.

Specialized data collection by role (T1005)

Database administrators may execute suspicious SQL backup jobs to export entire databases to local paths outside the standard backup schedule. Veeam administrators may query the Veeam database to access backup credentials. Salesforce users may perform bulk data transfers that exceed normal CRM export volume. AWS administrators may attempt to export EC2 virtual machine images. Credential harvesting before departure is a distinct category: Esentutl browser credential extraction, ADFS database access, and cryptocurrency wallet activity each produce distinct process creation or file access signatures that Log360's rules target.

Real-world incidents

Trade secret theft: departing engineers downloading IP before joining competitors

The most commonly litigated category of insider data theft involves engineers, product managers, or sales staff who download proprietary technical documentation, source code, customer lists, or pricing models in the days before their last day. The downloading behavior is characteristically compressed into a short window: the employee who has averaged 20 file accesses per day for two years suddenly opens 800 files in a single afternoon. The timing relative to the resignation date, combined with the specific file paths accessed, is what separates data hoarding from legitimate end-of-project file review.

Salesforce CRM data exfiltration by departing sales staff

Sales personnel departing to join a competitor frequently export CRM data: contact lists, deal history, account notes, and pipeline data. In Salesforce environments, bulk data export events above normal usage thresholds are detectable via Salesforce event monitoring. The Suspicious Bulk Data Transfer Activity in Salesforce rule fires when export volume significantly exceeds the user's established baseline. The combination of a large Salesforce export followed by Rclone or MEGA connection activity from the same user on the same day is a high-confidence data theft indicator.

Database administrator SQL backup exfiltration

A departing DBA who creates an ad hoc SQL backup job outside of the scheduled backup window, writing the backup to a non-standard path on their local workstation rather than the backup server, is the pattern detected by the Suspicious SQL backup activity rule. The combination of off-schedule timing, non-standard destination path, and proximity to a known departure date makes this pattern high-confidence in a termination risk monitoring context.

Exfiltration method reference table

Business impact

• Trade secret and IP loss. The theft of proprietary technical information, customer data, or business strategies by departing employees represents one of the highest-value categories of insider threat. Unlike ransomware, the damage from IP theft is often invisible until the competitor uses the stolen information, by which time it has already been fully exploited.
• Legal and regulatory exposure. Under trade secret protection laws such as the US Defend Trade Secrets Act and EU Trade Secrets Directive, and data protection regulations including GDPR and CCPA, unauthorized exfiltration of customer data by a departing employee creates legal exposure if the organization cannot demonstrate that adequate monitoring and access controls were in place.
• Customer relationship damage. CRM data and customer contact exfiltration by departing sales staff is a direct threat to customer relationships. Customers targeted by a former employee using data obtained from the corporate CRM have legal claims against the former employer if the exfiltration was not detected and the customer was not notified.
• Cost of forensic investigation. When data theft is discovered after the fact, the organization faces forensic investigation costs to determine what was taken, legal costs for civil proceedings, and the operational cost of remediating any access retained post-termination through forwarded email rules or harvested credentials.

Detecting employee termination risk with Log360

Log360's 29 detection rules for this use case cover the full spectrum of departing employee exfiltration behavior across five platforms. For Windows-based rules, Sysmon must be deployed with process creation (Event 1), network connection (Event 3), DNS query (Event 22), and file creation (Event 11) logging enabled. For M365 rules, unified audit logs must be configured and forwarding to Log360. For AWS, Salesforce, and Fortinet rules, the respective platform log sources must be configured as connectors in Log360.

Email collection and forwarding

Mass file access and SharePoint download

Cloud storage exfiltration

Tunneling tool exfiltration

Living-off-the-land exfiltration

Specialized data exfiltration by role

Behavior pattern visibility

Termination-risk data loss rarely shows up as a single event. It shows up as a pattern of behaviors concentrated in a short time window, often in the days immediately before or after a resignation is submitted.

Pattern A: Non-technical employee preparing to depart

Pattern B: Technical employee (developer) preparing to depart

Investigation playbook

Termination-risk investigations differ from external threat investigations in one critical dimension: the employee has legitimate access to all systems where the activity occurred. The investigation must establish that the access pattern was inconsistent with the employee's normal work behavior and consistent with data collection for external use. This distinction matters for both HR proceedings and any subsequent legal action.

Step 1: Establish the behavioral baseline before assessing the event

• Before treating any individual rule firing as a confirmed insider threat event, pull the employee's historical activity baseline from Log360 for the prior 90 days. What was their daily average file open count, which directories did they normally access, what was their typical data transfer volume, and did they previously access cloud storage services? Context from the baseline is what separates meaningful signals from noise in this use case.
• Check whether the employee has a known departure date. Known departures dramatically increase the significance of any data access anomaly: the same behavior that is borderline suspicious for an active employee is high-confidence exfiltration for an employee known to be leaving in two weeks.

Step 2: Correlate signals across detection rules

• In Log360's log search, query for all rule firings associated with the same username across the preceding 30 days. A user who triggered only one rule in isolation is much lower risk than one who triggered four different rules across four consecutive days. The concentration and diversity of signals is more predictive than any single rule firing.
• Look for the collection-then-exfiltration sequence: bulk file access or SharePoint downloads followed within 24 to 48 hours by connections to cloud storage services or tunnel tools. This two-phase pattern is the most common departure data theft workflow and is highly distinctive when both phases appear within the same investigation window.
• Check whether mail forwarding rules were created. If yes, all emails sent and received since the rule creation may have been copied to an external address, determining the scope of email data exposure independently of any file-based exfiltration.

Step 3: Investigate using the Incident Workbench

• Click on the employee's username in any alert to open the Incident Workbench. Use the User analytics tab to view the complete activity timeline, UEBA risk score, and behavioral deviation metrics. The UEBA risk score quantifies the degree of behavioral deviation across all monitored activities, not just the specific events that triggered individual rules.
• Review the activity overview to identify the specific files accessed, SharePoint sites visited, and external destinations contacted. For email forwarding cases, identify when the forwarding rule was created relative to other suspicious activity to establish the timeline of intent.
• Save the Incident Workbench session to an incident and flag it with the appropriate sensitivity level. Termination risk incidents frequently involve HR, Legal, and executive stakeholders, and the saved session provides the evidence record for those stakeholders without requiring raw log access.

Step 4: Determine scope of data exposure

• For email forwarding: identify when the rule was created and enumerate all emails that would have been copied to the external address since that date using M365 message trace.
• For SharePoint mass download: identify the specific document libraries and files downloaded using M365 unified audit log FileDownloaded events. Cross-reference with DLP sensitivity classifications if in use.
• For Rclone or MEGA exfiltration: the transferred content is not directly visible in logs. Scope must be inferred from file access events preceding the transfer: which files were accessed in the hours before the cloud storage connection, and do they match the employee's data domain?
• For credential harvesting via Esentutl or ADFS access: enumerate all corporate SaaS applications and systems where browser-saved credentials would provide access. Password rotation for those credentials must be initiated regardless of whether exfiltration is confirmed.

Step 5: Collect evidence for HR and legal proceedings

• Export all relevant log entries: M365 audit logs for forwarding rule creation and SharePoint downloads, Windows file access events, Sysmon process creation and network connection events. Preserve the chain of custody by exporting to a tamper-evident format and noting the export time.
• Export the Incident Workbench session timeline and UEBA risk score history. This provides a non-technical summary of the behavioral deviation suitable for HR review and legal proceedings.
• Document the comparison between the employee's 90-day baseline and the anomalous activity period. This comparison is the foundation of the insider threat case, demonstrating that the activity was inconsistent with normal job function.

Response and remediation

Immediate containment

• Remove any mail forwarding rules from the employee's M365 account immediately. Use the Exchange admin center or PowerShell (Remove-TransportRule) to delete the rule. Forwarding rules may continue to operate after account disablement in some configurations; explicit removal is required.
• Revoke active M365 sessions using Revoke-MgUserSignInSession to terminate any active browser sessions through which data may still be accessible.
• Block identified exfiltration destinations at the web filtering layer if exfiltration is ongoing: block MEGA, Rclone targets, or tunnel service domains for the specific workstation while investigation is in progress.
• Initiate accelerated offboarding in coordination with HR. In high-risk cases where significant data exfiltration is detected, immediate access termination rather than waiting for the planned last day reduces the ongoing exposure window.

Response actions by trigger

Process improvements

• Establish a formal elevated monitoring period triggered by HR notification of resignation or involuntary termination. When a departure is known in advance, UEBA anomaly thresholds for the departing employee's account can be tightened and specific rules placed on watchlist for immediate alerting.
• Implement a pre-offboarding access review that revokes access to the most sensitive systems (CRM, database admin tools, source code repositories) before the final departure date for roles with elevated data access risk.
• Integrate HR offboarding workflows with Log360 so that departing employee accounts are automatically placed under enhanced monitoring when an HR departure record is created. A SharePoint download alert from an employee with no known departure is Attention severity; the same alert from an employee with a confirmed departure date in three days is Critical.

False positive tuning