Admin Account Takeover Lab
A Global administrator is phished through an adversary-in-the-middle page at 02:44. The stolen token is replayed, an app gets a new secret, an MFA method appears and a mailbox rule hides the alerts. Make the calls — contain or watch, break-glass, persistence, federation, comms — and see how each one changes the night.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
At 02:47 an identity-protection alert fires on a.lindqvist (Global administrator), a Global administrator at Corvane Retail Group. The admin clicked a convincing sign-in page a few minutes earlier. Make the calls as incident lead: contain or watch, how to get admin rights when the admin is the problem, what the attacker left behind, whether federation was touched, and who to tell over which channel.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A realistic admin takeover with log lines and time stamps: adversary-in-the-middle phishing, token replay from a hosting provider, a new app credential, a new MFA method and an inbox rule.
- Your choices branch the story: watching instead of containing gives the attacker a second Global admin; skipping break-glass costs five hours; skipping the federation check lets them back in days later.
- Each decision is scored 0–10 with feedback on why it matters, what it costs and what it means for evidence and notification clocks.
- Rename the organisation and admin so the debrief is about you. Free to play; exporting the debrief is part of any PlayCISO plan.
Frequently asked questions
Why does a password reset not stop a phished admin?
Adversary-in-the-middle phishing steals the session token issued after MFA. The attacker replays that token, so the password is no longer involved. Revoking sessions and refresh tokens, and removing any MFA method the attacker added, is what ends their access.
What is a break-glass account?
An emergency administrator account kept for when normal admin access is unavailable or compromised. Good practice is at least two, cloud-only, with strong credentials stored securely and split between people, excluded from conditional access only as designed, and with an alert on every sign-in.
Why check federation after an admin compromise?
A Global admin can add a domain and set it to federated authentication against a server the attacker controls. That lets them sign in as any user in that domain without MFA, and it survives password resets. Checking domains and federation settings takes minutes.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.