All tabletop exercises
Identity·Advanced·Technical audience
An attacker holds Global Admin in your identity provider
The prompt — read this to the room
At 14:10 your SOC sees a new federated domain added to your cloud identity tenant, then a conditional access policy disabled. Both changes came from a Global Admin account belonging to a cloud engineer who is on holiday. Within twenty minutes, two new app registrations with mail-read permissions appear and three other admins report their MFA methods were changed. The attacker can now create users, issue tokens and read any mailbox. You are not sure which admin accounts are still yours. How do you take the tenant back without locking yourselves out?
Total duration
2 h 30 min
People to involve
6
Best fit
Any sector
Who to involve
Most important first.
- Incident response lead
- Cloud engineer
- SOC analyst
- IT operations
- CISO / Head of security
- CIO / CTO
What it tests
- Establish trusted admin access and an out-of-band channel before trying to evict the attacker.
- Plan and execute a coordinated eviction: sessions, tokens, federation trusts, app registrations and other persistence.
- Scope what the attacker read or changed from audit and sign-in logs.
- Agree the evidence needed before declaring the tenant clean.
Outline of activities
- 1Detection: tenant-level changes from a trusted account
- 2Which admins are still ours? Trusted access and out-of-band comms
- 3Planning the eviction
- 4Executing it, and the attacker’s response
- 5Scoping and declaring clean
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…