ArcanaIncident-response documentationBrowse the feedTemplates
Back to feed
Playbook
PB-004

Account Takeover

1. Purpose & Scope

  • Purpose:

    This playbook outlines the response process for account takeover (ATO) incidents - compromised workforce, service, SaaS, and cloud identities; session hijacking; credential abuse; MFA bypass; and unauthorised account activity. The objective is to revoke attacker access, determine what the identity accessed, restore secure access, and harden identity controls against repeat compromise.

  • Scope:

    Applies to all identity-compromise incidents across the organisation, including:

    • Staff / service / bot account compromise
    • Cloud IAM user, role, service account, managed identity, workload identity, or service principal compromise
    • Session, token, API key, access key, refresh token, or temporary credential theft
    • OAuth / consent-phishing abuse
    • Federated identity, role-assumption, or delegated access abuse
    • MFA bypass, MFA fatigue, and SIM-swap attacks
    • Credential stuffing and password spray

    For cloud control plane actions performed by a compromised identity, run PB-007: Cloud Compromise concurrently to investigate cloud resource, workload, storage, network, and security-service impact.

2. Incident Identification & Criteria

Incident Type: Account Takeover

Trigger Conditions:

Initiate this playbook when any of the following occur:

  • Anomalous sign-in alert (impossible travel, unusual geo/ASN, unusual device, risky sign-in) - generated by the IdP (SSO) or the Target Application (username/password auth).
  • MFA anomaly (fatigue, bypass, unauthorised enrolment)
  • Suspicious OAuth grant or consent prompt
  • Credential attack on an IdP or SaaS platform (stuffing, spray, brute force)
  • Session or token theft indicators (cookie / refresh token reuse from unexpected source)
  • Abnormal API key / service credential usage (new source, off-hours, unexpected scope)
  • User reports unrecognised activity (e.g., being unexpectedly logged out of active sessions, unauthorised messages/commits sent from their profile, or MFA prompts they didn't initiate).
  • External credential exposure (breach dumps, paste sites, threat intel)

Severity Levels:

SeverityDescription
Sev 3Confirmed compromise of a single non-privileged account
Sev 2Confirmed compromise of multiple non-privileged accounts
Sev 1Privileged / administrative account compromise, or large-scale multi-account compromise
Sev 0IdP / IAM infrastructure compromise, or compromise of identity-critical service accounts

3. Roles & Responsibilities

  • Incident Commander: Coordinates and leads the response; owns decisions on containment timing, privilege escalation, and external communications.
  • Communications Lead: Manages internal updates, executive briefings, and user / customer notification messaging.
  • Identity & Access (IAM) Team: Owns account lockdown, session/token revocation, MFA reset, OAuth grant remediation, and IdP-side hardening; acts as technical lead for identity actions.
  • Incident Responder / Forensic Analyst: Performs authentication log analysis, OAuth consent review, credential exposure investigation, and hunting for other compromised accounts; preserves identity telemetry as evidence.
  • Other Roles:
    • Endpoint / EDR Team: Investigates endpoints used by the compromised account for credential-theft malware, browser token theft, and persistence; isolates impacted devices.
    • Cloud / Platform Team: Reviews cloud IAM users, roles, service accounts, managed identities, workload identities, service principals, access keys, federated identity, and cloud control plane impact.
    • HR / People Team: Required where the impacted user must be contacted out-of-band, where account recovery requires identity proofing, or where insider threat is suspected.
    • Legal / Privacy: Assesses regulatory and breach notification obligations where personal data, regulated data, or financial activity is affected.

4. Initial Actions

  • Immediate Steps:

    • Perform identity alert triage to validate the alert and assess immediate risk

      Decision Point:

      • If false positive → close with documentation
      • If true positive → continue
    • Lock down the impacted account(s) to prevent continued attacker access (disable sign-in, block at IdP, or apply conditional access block as appropriate)
    • Revoke all active sessions and refresh tokens for the impacted account(s) - password reset alone does not terminate existing sessions
    • Notify Incident Response leadership and assign roles
    • Contact the impacted user out-of-band (phone, in-person, or alternate channel) to confirm the activity is unauthorised and to coordinate recovery - never via the potentially compromised channel

    Warning: Do NOT assume compromise is limited to a single identity until session activity, OAuth grants, adjacent accounts, and lateral movement have all been assessed. Identity compromise frequently leads to broader environment access via stolen tokens, malicious OAuth grants, and trust chains.

5. Investigation & Analysis

  • Evidence Collection:
    • For the impacted account(s), collect the following identity telemetry over the incident window:
      • Authentication / sign-in events - focus on first suspicious sign-in, source IP/ASN/geo, user-agent, device, and conditional-access outcomes
      • MFA events - factor used, factor enrolments / removals, fatigue / bypass signals
      • Session and token events - issuance, refresh, revocation, and token reuse from unexpected sources
      • OAuth / consent and third-party application access
      • Directory / identity management events - role assignments, group changes, password resets, privileged actions
      • 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
    • Where a specific device is implicated, also collect endpoint-side telemetry for that host
    • Record source IPs, ASNs, user-agents, and device IDnalyse authentication logs to build the compromise timeline (first suspicious sign-in, source IP/geo/ASN/device, MFA outcomes) and identify all sessions issued post-compromise
    • Investigate credential exposure to identify the initial access vector (phishing, infostealer/credential-theft malware, password reuse from a public breach, brute force / spray, OAuth consent phishing, token theft from endpoint/browser)

    Decision Point: For each identified initial access vector, run the post-detection phases (Analysis → Recovery) of the relevant playbook concurrently alongside this one:

    • Review OAuth grants and third-party application access - attackers frequently establish persistent access through malicious OAuth applications that survives a password reset
    • Assess privileged access exposure - review privileged actions taken by the account, role assignments granted, group memberships modified, and admin consent provided during the compromise window

    Decision Point:

    • If privileged account compromise confirmed → escalate severity to Sev 1+ and engage IAM leadership immediately; assess IdP-wide integrity (federation trust, sync accounts, break-glass accounts, custom roles).
    • Hunt for adjacent compromised accounts using shared indicators from the initial compromise (source IPs, user-agents, device IDs, OAuth application IDs, MFA factor metadata)
    • Where the compromised account interacted with hosts, review endpoint activity for credential-theft tooling, browser token theft, and persistence
    • Where the compromised identity performed cloud control plane actions, run PB-007: Cloud Compromise concurrently to investigate cloud resource, workload, storage, network, and security-service impact.
    • Document findings, attack timeline, scope of compromise, and indicators of compromise (IOCs)

6. Containment, Eradication & Recovery

Warning: Do NOT restore user access until:

  • All sessions and tokens have been revoked
  • MFA factors have been reset and re-enrolled by the genuine user
  • Malicious OAuth grants have been removed
  • The initial access vector has been identified and remediated
  • No other accounts have been confirmed as compromised

Premature recovery commonly results in immediate re-compromise via residual tokens, OAuth persistence, or unaddressed root cause.

  • Containment Actions:

    • Short-term (immediate) containment:
    • Long-term (directory) containment:

      Decision Point:

      • If privileged / Tier-0 account compromise confirmed → escalate to enterprise-wide identity response and treat as Sev 1+ identity infrastructure incident.

  • Eradication Steps:

    • Reset the account password and any associated app passwords / API keys / programmatic credentials
    • Remove all malicious OAuth grants, mailbox rules, forwarding rules, and delegate access
    • Revoke any persistence established by the attacker during the compromise window (new role assignments, new group memberships, new federated identity grants, new service principal credentials)
    • Where credential-theft malware is suspected on an associated endpoint, follow PB-003: Endpoint Malware Infection for endpoint eradication

    Note: Where the compromise cannot be reliably remediated in place (e.g. extensive persistence, unknown root cause), eradicate by re-issuing identity - new account, new MFA enrolment, fresh provisioning - and rebuild any associated endpoint via RB-RECOVERY-002: Clean System Rebuild.

  • Recovery Steps:

    • Verify the genuine user's identity out-of-band before restoring access
    • Restore user access in a controlled, validated manner with fresh MFA enrolment and a forced password change at first sign-in
    • Monitor the restored account closely for reuse of the prior attack pattern (same source IPs, user-agents, OAuth applications, MFA factors) for an extended window post-recovery

      Decision Point:

      • If recompromise activity observed → halt recovery immediately, return to containment, and reassess for missed persistence.

7. Communication & Escalation

  • Internal Communication:

    • Notify the impacted user out-of-band and brief them on what occurred and the recovery process
    • Notify the user's manager and affected business unit
    • Provide regular incident updates to leadership; brief leadership immediately if privileged or service account compromise is confirmed
    • Issue org-wide identity advisory if a campaign-style attack is observed (e.g. OAuth consent phishing targeting multiple users)

  • External Communication:

    • Engage Legal/Privacy to assess regulatory and breach notification obligations where personal data, regulated data, or financial activity was accessed
    • Notify customers, regulators, and partners as directed by Legal
    • Coordinate all external messaging with Communications Lead and Legal

  • Escalation Criteria:

    ConditionEscalate To
    Phishing identified as initial access vectorPB-001: Phishing & Credential Theft
    Endpoint credential-theft malware identified as initial access vectorPB-003: Endpoint Malware Infection
    Business email compromise pattern observedPB-016: Business Email Compromise
    Data exfiltration confirmedPB-005: Data Exfiltration
    Compromised identity performed cloud control plane actionsPB-007: Cloud Compromise
    Widespread identity compromise or IdP/IAM infrastructure impactPB-019: Major Security Incident Management / Executive escalation

8. Post-Incident Activities

  • Lessons Learned:

    • Schedule and conduct a Post-Incident Review (PIR)
    • Document what went well and what needs improvement
    • Review control failures (MFA enforcement, conditional access, OAuth governance, privileged access controls, detection coverage)
    • Identify and close detection gaps for the initial access vector and the compromise behaviour observed

  • Identity Hardening:

    • Strengthen MFA posture (phishing-resistant factors such as FIDO2/passkeys for privileged users; remove SMS for high-risk roles)
    • Tighten conditional access (block legacy authentication, geo/risk-based policies, device compliance requirements)
    • Reduce standing privilege (just-in-time access, time-bound role assignments, privileged access workstations)
    • Improve OAuth governance (admin consent workflows, restrict user consent for unverified publishers, periodic OAuth grant reviews)
    • Strengthen session policies (shorter session lifetimes for privileged roles, sign-in frequency requirements)

  • Documentation Updates:

    • Update this playbook, linked runbooks, and KB articles to reflect lessons learned
    • Update detections and threat intelligence based on observed TTPs (source infrastructure, OAuth app IDs, attack patterns)

9. References & Linked Resources

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.