The Phishing Cluster With a Deadline
A security operations center sees 47 reports of a credential-phishing email over six hours. The messages spoof the internal payroll portal and link to a domain registered nine days ago. Two users clicked; one entered credentials. The identity provider logs show a successful login from an unfamiliar country 22 minutes after the click, followed by an MFA prompt that was approved - the user says she did not approve it. The attacker has not yet changed the password or enrolled a new device. The SOC has a 30-minute detection-to-containment SLA and a change freeze that begins in four hours for quarter-end close. The identity team wants to reset the password; the SOC lead wants to revoke sessions and disable the account first.
1. What is the correct containment order for the compromised identity, and why does order matter here?
Read the worked answer
Order matters because each action closes a different door, and doing them in the wrong sequence can either tip off the attacker or leave a valid session alive.
Recommended sequence:
- Revoke all refresh tokens / active sessions for the account. Password reset alone does not kill an existing session; the attacker may keep a valid token and continue. This is the single most important step and should come first or simultaneously.
- Disable the account (or force sign-out and block sign-in) to stop new authentications while investigation proceeds.
- Reset the password and re-register MFA - the approved MFA prompt suggests the attacker may have enrolled a method or is performing MFA fatigue. Removing unknown authentication methods is essential; a password reset that leaves the attacker's MFA device enrolled is incomplete.
- Review and revoke any OAuth consent grants or app registrations created during the session, and check for mailbox rules or forwarding set up by the attacker.
Why not password-first: a reset while the session lives can leave the attacker active and may prompt them to accelerate (data exfiltration, mailbox rules). Revoking sessions first shrinks their window. The change freeze is a policy constraint, not a technical one; security containment should proceed and the freeze owner notified, since a compromised identity during quarter-end close is a material risk.
2. The change freeze begins in four hours. How should the SOC lead reconcile the freeze with the need to contain and investigate?
Read the worked answer
The freeze governs planned changes, not emergency security response. The lead should:
- Classify the containment actions as an emergency change under the existing change-management policy, which typically has an emergency path. Document the justification and get the minimal required approval (often the change manager or on-call authority) rather than waiting for a full CAB.
- Notify the freeze owner and finance leadership that a compromised identity exists during close, because the business impact of the attacker persisting through close (fraudulent payments, data theft) outweighs the risk of an out-of-band change.
- Scope the emergency changes narrowly - only the affected account, sessions, and MFA methods - to avoid broad changes that could disrupt close.
- Timebox the investigation so the freeze owner has a clear expectation: containment now, deeper forensics in parallel, and a decision point before close activity peaks.
The judgement being tested is that a freeze is a coordination constraint to be managed, not a reason to leave an active intruder in place.