All tabletop exercises
Identity·Intermediate·Technical audience
Stolen session tokens bypass MFA
The prompt — read this to the room
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
Total duration
2 h
People to involve
5
Best fit
Saas
Who to involve
Most important first.
- Incident response lead
- SOC analyst
- Cloud engineer
- IT operations
- CISO / Head of security
What it tests
- Explain why a password reset and MFA do not stop session token replay, and which revocations do.
- Remove every foothold: sessions, refresh tokens, app consents, registered devices and downstream app sessions.
- Scope access across mail, file storage and SSO-connected applications from logs.
- Decide on controls: phishing-resistant MFA, token protection and device-based access policies.
Outline of activities
- 1Why the password reset did nothing
- 2Revoking everything the session touched
- 3Scoping mail, files and connected apps
- 4Other recipients of the same lure
- 5Control decisions and hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…