PB-004: Account Takeover

Document Control

1. Purpose & Scope

• Purpose:

  This playbook outlines the response process for account takeover (ATO) incidents - compromised workforce, service, SaaS, and cloud identities; session hijacking; credential abuse; MFA bypass; and unauthorised account activity. The objective is to revoke attacker access, determine what the identity accessed, restore secure access, and harden identity controls against repeat compromise.

• Scope:

  Applies to all identity-compromise incidents across the organisation, including:

  • Staff / service / bot account compromise
  • Cloud IAM user, role, service account, managed identity, workload identity, or service principal compromise
  • Session, token, API key, access key, refresh token, or temporary credential theft
  • OAuth / consent-phishing abuse
  • Federated identity, role-assumption, or delegated access abuse
  • MFA bypass, MFA fatigue, and SIM-swap attacks
  • Credential stuffing and password spray

  For cloud control plane actions performed by a compromised identity, run PB-007: Cloud Compromise concurrently to investigate cloud resource, workload, storage, network, and security-service impact.

2. Incident Identification & Criteria

Incident Type: Account Takeover

Trigger Conditions:

Initiate this playbook when any of the following occur:

• Anomalous sign-in alert (impossible travel, unusual geo/ASN, unusual device, risky sign-in) - generated by the IdP (SSO) or the Target Application (username/password auth).
• MFA anomaly (fatigue, bypass, unauthorised enrolment)
• Suspicious OAuth grant or consent prompt
• Credential attack on an IdP or SaaS platform (stuffing, spray, brute force)
• Session or token theft indicators (cookie / refresh token reuse from unexpected source)
• Abnormal API key / service credential usage (new source, off-hours, unexpected scope)
• User reports unrecognised activity (e.g., being unexpectedly logged out of active sessions, unauthorised messages/commits sent from their profile, or MFA prompts they didn't initiate).
• External credential exposure (breach dumps, paste sites, threat intel)

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Coordinates and leads the response; owns decisions on containment timing, privilege escalation, and external communications.
• Communications Lead: Manages internal updates, executive briefings, and user / customer notification messaging.
• Identity & Access (IAM) Team: Owns account lockdown, session/token revocation, MFA reset, OAuth grant remediation, and IdP-side hardening; acts as technical lead for identity actions.
• Incident Responder / Forensic Analyst: Performs authentication log analysis, OAuth consent review, credential exposure investigation, and hunting for other compromised accounts; preserves identity telemetry as evidence.
• Other Roles:
  • Endpoint / EDR Team: Investigates endpoints used by the compromised account for credential-theft malware, browser token theft, and persistence; isolates impacted devices.
  • Cloud / Platform Team: Reviews cloud IAM users, roles, service accounts, managed identities, workload identities, service principals, access keys, federated identity, and cloud control plane impact.
  • HR / People Team: Required where the impacted user must be contacted out-of-band, where account recovery requires identity proofing, or where insider threat is suspected.
  • Legal / Privacy: Assesses regulatory and breach notification obligations where personal data, regulated data, or financial activity is affected.

4. Initial Actions

• Immediate Steps:

  • Perform identity alert triage to validate the alert and assess immediate risk
    • 📘 RB-TRIAGE-003: Identity Alert Triage

    Decision Point:

    • If false positive → close with documentation
    • If true positive → continue

  • Lock down the impacted account(s) to prevent continued attacker access (disable sign-in, block at IdP, or apply conditional access block as appropriate)
    • 📘 RB-CONTAIN-001: Account Lockdown
  • Revoke all active sessions and refresh tokens for the impacted account(s) - password reset alone does not terminate existing sessions
    • 📘 RB-CONTAIN-005: Session Token Revocation
  • Notify Incident Response leadership and assign roles
  • Contact the impacted user out-of-band (phone, in-person, or alternate channel) to confirm the activity is unauthorised and to coordinate recovery - never via the potentially compromised channel

  Warning: Do NOT assume compromise is limited to a single identity until session activity, OAuth grants, adjacent accounts, and lateral movement have all been assessed. Identity compromise frequently leads to broader environment access via stolen tokens, malicious OAuth grants, and trust chains.

5. Investigation & Analysis

• Evidence Collection:
  • For the impacted account(s), collect the following identity telemetry over the incident window:
    • Authentication / sign-in events - focus on first suspicious sign-in, source IP/ASN/geo, user-agent, device, and conditional-access outcomes
    • MFA events - factor used, factor enrolments / removals, fatigue / bypass signals
    • Session and token events - issuance, refresh, revocation, and token reuse from unexpected sources
    • OAuth / consent and third-party application access
    • Directory / identity management events - role assignments, group changes, password resets, privileged actions
    • 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • Where a specific device is implicated, also collect endpoint-side telemetry for that host
    • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
  • Record source IPs, ASNs, user-agents, and device IDnalyse authentication logs to build the compromise timeline (first suspicious sign-in, source IP/geo/ASN/device, MFA outcomes) and identify all sessions issued post-compromise
    • 📘 RB-ANALYSIS-007: Authentication Log Analysis
  • Investigate credential exposure to identify the initial access vector (phishing, infostealer/credential-theft malware, password reuse from a public breach, brute force / spray, OAuth consent phishing, token theft from endpoint/browser)
    • 📘 RB-ANALYSIS-010: Credential Exposure Investigation

  Decision Point: For each identified initial access vector, run the post-detection phases (Analysis → Recovery) of the relevant playbook concurrently alongside this one:

  • Phishing → PB-001: Phishing & Credential Theft
  • Endpoint credential-theft malware (e.g. infostealer) → PB-003: Endpoint Malware Infection
  • Business email compromise pattern observed → PB-016: Business Email Compromise

  • Review OAuth grants and third-party application access - attackers frequently establish persistent access through malicious OAuth applications that survives a password reset
    • 📘 RB-ANALYSIS-008: OAuth Application Consent Review
  • Assess privileged access exposure - review privileged actions taken by the account, role assignments granted, group memberships modified, and admin consent provided during the compromise window
    • 📘 RB-ANALYSIS-009: Privileged Access Assessment

  Decision Point:

  • If privileged account compromise confirmed → escalate severity to Sev 1+ and engage IAM leadership immediately; assess IdP-wide integrity (federation trust, sync accounts, break-glass accounts, custom roles).

  • Hunt for adjacent compromised accounts using shared indicators from the initial compromise (source IPs, user-agents, device IDs, OAuth application IDs, MFA factor metadata)
    • 📘 RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • Where the compromised account interacted with hosts, review endpoint activity for credential-theft tooling, browser token theft, and persistence
  • Where the compromised identity performed cloud control plane actions, run PB-007: Cloud Compromise concurrently to investigate cloud resource, workload, storage, network, and security-service impact.
  • Document findings, attack timeline, scope of compromise, and indicators of compromise (IOCs)

6. Containment, Eradication & Recovery

Warning: Do NOT restore user access until:

• All sessions and tokens have been revoked
• MFA factors have been reset and re-enrolled by the genuine user
• Malicious OAuth grants have been removed
• The initial access vector has been identified and remediated
• No other accounts have been confirmed as compromised

Premature recovery commonly results in immediate re-compromise via residual tokens, OAuth persistence, or unaddressed root cause.

• Containment Actions:

  • Short-term (immediate) containment:
    • Account lockdown and session/token revocation (see Initial Actions)
    • Revoke or restrict any malicious OAuth grants identified during analysis
      • 📘 RB-ANALYSIS-008: OAuth Application Consent Review
    • Reset MFA factors and remove rogue / attacker-enrolled MFA devices
      • 📘 RB-CONTAIN-006: MFA Reset & Validation
    • Remove malicious mailbox rules, forwarding rules, and delegate access on email accounts
  • Long-term (directory) containment:
    • Where on-premises Active Directory accounts are compromised, perform AD-side containment (reset, KRBTGT rotation if Tier-0 compromise, group membership review)
      • 📘 RB-CONTAIN-003: Active Directory Containment

    Decision Point:

    • If privileged / Tier-0 account compromise confirmed → escalate to enterprise-wide identity response and treat as Sev 1+ identity infrastructure incident.

• Eradication Steps:

  • Reset the account password and any associated app passwords / API keys / programmatic credentials
  • Remove all malicious OAuth grants, mailbox rules, forwarding rules, and delegate access
  • Revoke any persistence established by the attacker during the compromise window (new role assignments, new group memberships, new federated identity grants, new service principal credentials)
  • Where credential-theft malware is suspected on an associated endpoint, follow PB-003: Endpoint Malware Infection for endpoint eradication

  Note: Where the compromise cannot be reliably remediated in place (e.g. extensive persistence, unknown root cause), eradicate by re-issuing identity - new account, new MFA enrolment, fresh provisioning - and rebuild any associated endpoint via RB-RECOVERY-002: Clean System Rebuild.

• Recovery Steps:

  • Verify the genuine user's identity out-of-band before restoring access
  • Restore user access in a controlled, validated manner with fresh MFA enrolment and a forced password change at first sign-in
    • 📘 RB-RECOVERY-003: User Recovery & Access Restoration
  • Monitor the restored account closely for reuse of the prior attack pattern (same source IPs, user-agents, OAuth applications, MFA factors) for an extended window post-recovery

    Decision Point:

    • If recompromise activity observed → halt recovery immediately, return to containment, and reassess for missed persistence.

7. Communication & Escalation

• Internal Communication:

  • Notify the impacted user out-of-band and brief them on what occurred and the recovery process
    • 📘 SOP-004: User Notification
  • Notify the user's manager and affected business unit
  • Provide regular incident updates to leadership; brief leadership immediately if privileged or service account compromise is confirmed
  • Issue org-wide identity advisory if a campaign-style attack is observed (e.g. OAuth consent phishing targeting multiple users)

• External Communication:

  • Engage Legal/Privacy to assess regulatory and breach notification obligations where personal data, regulated data, or financial activity was accessed
  • Notify customers, regulators, and partners as directed by Legal
  • Coordinate all external messaging with Communications Lead and Legal
    • 📘 SOP-003: Escalation, Legal & Executive Communications

• Escalation Criteria:

  Condition	Escalate To
  Phishing identified as initial access vector	PB-001: Phishing & Credential Theft
  Endpoint credential-theft malware identified as initial access vector	PB-003: Endpoint Malware Infection
  Business email compromise pattern observed	PB-016: Business Email Compromise
  Data exfiltration confirmed	PB-005: Data Exfiltration
  Compromised identity performed cloud control plane actions	PB-007: Cloud Compromise
  Widespread identity compromise or IdP/IAM infrastructure impact	PB-019: Major Security Incident Management / Executive escalation

8. Post-Incident Activities

• Lessons Learned:

  • Schedule and conduct a Post-Incident Review (PIR)
  • Document what went well and what needs improvement
  • Review control failures (MFA enforcement, conditional access, OAuth governance, privileged access controls, detection coverage)
  • Identify and close detection gaps for the initial access vector and the compromise behaviour observed

• Identity Hardening:

  • Strengthen MFA posture (phishing-resistant factors such as FIDO2/passkeys for privileged users; remove SMS for high-risk roles)
  • Tighten conditional access (block legacy authentication, geo/risk-based policies, device compliance requirements)
  • Reduce standing privilege (just-in-time access, time-bound role assignments, privileged access workstations)
  • Improve OAuth governance (admin consent workflows, restrict user consent for unverified publishers, periodic OAuth grant reviews)
  • Strengthen session policies (shorter session lifetimes for privileged roles, sign-in frequency requirements)

• Documentation Updates:

  • Update this playbook, linked runbooks, and KB articles to reflect lessons learned
  • Update detections and threat intelligence based on observed TTPs (source infrastructure, OAuth app IDs, attack patterns)

9. References & Linked Resources

• Playbooks:

  • PB-001: Phishing & Credential Theft
  • PB-003: Endpoint Malware Infection
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-016: Business Email Compromise
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-003: Identity Alert Triage
  • RB-CONTAIN-001: Account Lockdown
  • RB-CONTAIN-003: Active Directory Containment
  • RB-CONTAIN-005: Session Token Revocation
  • RB-CONTAIN-006: MFA Reset & Validation
  • RB-ANALYSIS-007: Authentication Log Analysis
  • RB-ANALYSIS-008: OAuth Application Consent Review
  • RB-ANALYSIS-009: Privileged Access Assessment
  • RB-ANALYSIS-010: Credential Exposure Investigation
  • RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-003: User Recovery & Access Restoration

• SOPs:

  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-004: User Notification

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.