From Insider Threats to Insider Allies: Enhancing Detection Methods for Privileged Users