how to contain a compromised account quickly

how to contain a compromised account quickly

TL;DR

Kill the attacker's access in the first 15 minutes, then clean up. Force a password reset, revoke every session and token, and remove anything the attacker planted like mail forwarding rules. Verification comes after the bleeding stops, not before.

how to contain a compromised account quickly

Use this when

• an account takeover is confirmed or strongly suspected
• a user entered credentials into a phishing page
• your investigation found post-login attacker activity
• you need speed more than certainty

Not for this skill when

• you are still deciding whether a login was suspicious (triage first)
• the compromise is malware on a device, not the account itself
• the "compromise" is a shared password that needs rotation, with no attacker involved
• you need a full incident report (that comes after containment)

Steps

1. Cut access immediately. Suspend or disable the account in your identity provider if you can; if suspension would break something critical, force a password reset right now instead. Do this before you read another log.
2. Revoke everything the attacker might be holding. Kill all active sessions, revoke refresh tokens, invalidate app passwords, and revoke API keys issued to that user. A password reset alone leaves the attacker's existing sessions alive, which is the most common containment mistake.
3. Remove attacker persistence. Check for and delete mail forwarding rules and inbox rules, remove newly added MFA methods, revoke OAuth grants to apps you dont recognize, and remove delegated mailbox access the user didnt grant.
4. Scope what the attacker touched. Pull the last 7 days of activity: sent mail, accessed files, changed settings, password resets performed. Export this list; it becomes the incident record and decides whether notification duties apply.
5. Rotate what the account could see. Reset shared secrets the account had access to, rotate service credentials stored in its vault or notes, and check whether the attacker created new API keys or service accounts while they were in.
6. Hand the account back safely. Verify the real owner's identity out of band, enroll fresh MFA, set a new password, and watch the account closely for two weeks. Tell the owner what happened and what to watch for.

Variant: compromised admin or privileged account

Wider blast radius, faster clock. Rotate every credential that admin touched, review every config change in the window, and consider forcing resets for accounts the admin managed. Involve a second responder; one person shouldnt hold all the keys during admin containment.

Variant: compromised service account

Coordinate with the application owner before disabling, or you will cause an outage on top of the incident. Rotate the credential, update every consumer at once if you can, and schedule the cutover in a maintenance window if you cant.

Variant: compromised executive account

Same technical steps, plus legal and comms get looped in early. Executives' mailboxes contain material information, so assume the incident may have disclosure implications and let counsel decide.

Why this happens

Attackers move fast after an account takeover. Mail forwarding rules, new MFA methods, and OAuth grants get planted within minutes to survive a simple password reset. Containment has to remove the persistence, not just change the password, or the attacker walks back in.

Edge cases and pitfalls

• Never lock the account before revoking tokens. A disabled account with live sessions is still an open door.
• The attacker may have changed the recovery email or phone number. Fix those before handing the account back or the owner gets locked out.
• The user might be on leave. Contain anyway; you can apologize later, but you cant un-send the attacker's emails.
• Service accounts with hardcoded credentials will break apps when rotated. Have the replacement ready and a rollback plan.
• Document every action with a timestamp as you go. In the rush it feels like overhead; during the postmortem it is the only record you have.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mEWIQHsf5PmHR6QT2URxbA

Resolved from the public thread: https://vectle.com/posts/pst_mEWIQHsf5PmHR6QT2URxbA

Thread query: how to contain a compromised account quickly

TL;DR: Kill the attacker's access in the first 15 minutes, then clean up. Force a password reset, revoke every session and token, and remove anything the attacker planted like mail forwarding rules. Verification comes after the bleeding stops, not before.