Phishing Incident with Credential Compromise and Lateral Movement
Northwind's SOC receives a Defender XDR incident: a user clicked a link in a phishing email, entered credentials on a lookalike page, and 12 minutes later a sign-in from a new country succeeded with MFA satisfied (the attacker used an adversary-in-the-middle proxy to steal the session token). Twenty minutes after that, the attacker created a mailbox rule forwarding finance emails to an external address, then attempted sign-ins to three other users' accounts from the same IP, two of which succeeded. The incident is currently 'Active' with severity 'High'. The user whose credentials were stolen is the AP clerk; the two other compromised accounts include the controller. It is 02:00 local time and only one analyst is on shift.
1. Order the containment actions for the first 30 minutes and justify the sequence. Explain why password reset alone is insufficient.
Read the worked answer
Sequence by blast radius, not by convenience:
- Revoke sessions and refresh tokens for all three compromised accounts first. Because the attacker stole a session token via AiTM, a password reset does not invalidate the live session; only revocation kills it. Do this before anything else so the attacker cannot re-establish access mid-response.
- Disable or block sign-in for the three accounts, and reset passwords (order matters less once sessions are revoked, but do both).
- Remove the malicious mailbox rule and search for any other forwarding rules or OAuth consent grants on the three accounts.
- Block the attacker IP at the network and in Conditional Access (named location block), and add it to the Sentinel watchlist.
- Isolate any device the compromised accounts signed into if endpoint telemetry shows suspicious process activity.
- Notify the controller and finance leadership out-of-band (phone, not email) because finance mail is being exfiltrated.
Password reset alone is insufficient because the AiTM proxy captured the authenticated session; the token remains valid until expiry or revocation. The attacker also satisfied MFA at the proxy, so MFA did not stop them and will not stop a re-login if the token persists.
2. The single on-shift analyst must also preserve evidence and hand off. What artifacts should be captured, and what should be escalated versus handled locally?
Read the worked answer
Capture before remediation where feasible:
- Sign-in logs for all three accounts for the last 7 days (export to a case evidence store).
- The phishing email (raw headers, sender, URL) and the lookalike domain registration data.
- Mailbox audit logs showing the rule creation and any forwarded messages.
- The attacker IP's full activity across the tenant (any other accounts touched).
- Endpoint timeline for any device the accounts used.
Escalate immediately (wake someone):
- The controller and any finance account compromise - this is a potential financial fraud event and needs leadership and possibly legal/privacy involvement.
- The AiTM phishing infrastructure - a second wave against other staff is likely; the email gateway team must block the domain and purge the message tenant-wide.
Handle locally:
- Session revocation, password resets, mailbox rule removal, IP block, and initial evidence export. These are within one analyst's authority at 02:00 and are time-critical.
Document each action in the incident timeline so the morning shift can reconstruct the sequence and verify nothing was missed.