User-Privilege Population Analysis

What it detects

Find users performing privileged actions that are unusual compared with similar users. The technique can identify rare administrative behavior, unexpected privilege use, or an abnormal increase in privileged activity.¹

Create meaningful peer populations such as:

• Finance users
• Developers
• Help desk
• Administrators
• Service accounts

Do not compare fundamentally different user populations under one baseline.

Telemetry and fields

Use identity, endpoint, directory, cloud, and application audit telemetry with:

• Timestamp
• User, SID, principal, or stable identity ID
• User role, department, account type, and peer group
• Privileged action or event type
• Privilege, role, group, or token used
• Target host, account, resource, or object
• Source host, IP, process, and session ID
• Authentication method and elevation mechanism
• Result or status

Implementation

1. Assign identities to relevant peer groups.
2. Baseline the types, targets, frequency, and timing of privileged actions for each group.
3. Calculate rarity or deviation for each user relative to peers and the user's own history.
4. Surface first-seen actions, rare targets, unusual volume, or behavior outside the expected role.

Use counts, percentiles, rarity functions, median/deviation methods, historical lookups, or SIEM/EDR anomaly models.

Feature model

Combine peer comparison with each user's own history. The source highlights three complementary signals: rare privileged action types, actions outside the user's role population, and a burst or ratio change in privileged activity.

Feature	Purpose
privileged_action_count	Detect unusual administrative volume
distinct_privileged_targets	Expose expansion into new hosts, accounts, or resources
elevated_child_count / total_child_count	Detect a sudden change in elevated process creation
first_seen_action	Identify a privileged operation absent from the user's history
peer_prevalence	Measure how many comparable users perform the same action
target_rarity	Surface uncommon critical files, registry keys, roles, or systems
time_since_authentication	Tie privileged behavior to an interactive or explicit administrative session

user + peer group + privileged action
  → expected frequency and targets
  → deviation or rare combination

Population hygiene

Record peer-group membership as time-aware enrichment. Department, role, service-account purpose, and administrative assignment can change; evaluate an event against the group valid at the event time. Keep service accounts, break-glass identities, automation, help-desk operators, and full administrators in separate populations.

A peer outlier may be normal for that user's established history, while a self-history outlier may be common among peers. Rank events higher when both comparisons agree.

Interesting results

Prioritize:

• A finance user performing an administrative action absent from finance peers
• A help-desk user accessing an unusual privileged target
• A service account performing interactive or previously unseen administration
• A user's privileged-action rate far above the peer baseline
• First-time role assignment, group change, policy change, credential creation, or security-control modification
• An anomaly followed by lateral movement, persistence, sensitive data access, or defensive evasion

Key question: Is this privileged action expected for this user's role, peer group, normal targets, and historical behavior?

---

1. Gianluca Tiepolo and Dan Sorensen, Advanced Cyber Threat Intelligence and Hunting, first edition, Packt, 2026, Chapter 6, "Privilege escalation and token abuse," supplied EPUB extraction lines 393–415. ↩