Account takeover response: the session left open

The identity provider flags a sign-in from a new country on a sales rep’s account. An analyst emails the rep, who replies after lunch to say it wasn’t them. IT resets the password within the hour.

The attacker’s session was already open, and the reset doesn’t end it. For two more days, they read the rep’s inbox through that session. The forwarding rule they set up on the first morning sends a copy of every new email outside the company.

Compromised account response is the part of security operations where minutes matter most. A response that only resets the password leaves the attacker’s other ways back in.

What is account takeover response?

Account takeover response checks a risky sign-in with the account’s owner. When the owner confirms it wasn’t them, it removes the attacker’s access completely: it revokes every open session, resets the password and second factor, and removes anything the attacker set up, such as mail rules or app grants.

Why the attacker keeps access

1. A password reset doesn’t end sessions. Tokens issued before the reset keep working until they expire.
2. Nobody checks for persistence. Mail forwarding rules, new devices and app grants stay in place.
3. Confirming with the user takes hours. The analyst sends an email, and the user reads it after lunch.
4. The response runs in several tools. Identity, email and the service desk each need a separate step, often by a different team.
5. Nobody checks what was accessed. The review of what the attacker read waits for someone with time.

What it costs

Every hour the attacker keeps a session open is an hour of reading email, files and customer records. A mail rule keeps leaking data after the account looks recovered. An account the attacker still controls can also send the next phishing email from inside the company.

What to fix first

1. Ask the user in chat straight away. A Slack or Teams message with “This was me” and “This wasn’t me” buttons gets an answer in minutes.
2. Revoke every session on a confirmed takeover. Do it before the reset, in the identity provider and in the apps that keep their own sessions.
3. Remove what the attacker set up. Check for and remove mail rules, new MFA devices and recent app grants.
4. Run the steps as one response. One workflow covers identity, email and the service desk ticket, with no handoffs.
5. Send administrator accounts to a person. Cutting off an admin needs approval, with the evidence attached.

The guide to building compromised account response has the prompts for each step.

Where it fits

Many takeovers start with a phishing email, and they’re spotted when alert triage works on fresh sign-in logs. The same steps that end an attacker’s access also end an employee’s when they leave, which is the job of employee offboarding.

For every part of security operations, from first alert to shipped fix, see SOC automation.