Detect trusted users who do authorized things with a malicious intent