13.7 Containment Playbook

Containment Playbook

You have confirmed token replay for j.morrison. The attacker is actively accessing the mailbox. Every second of delay means more emails read, more intelligence gathered, more risk of lateral movement. Containment follows a strict sequence.

The 7-step containment sequence

Step 1: Revoke all sessions. Defender portal, User entity, Actions, Revoke sessions. This invalidates ALL active tokens, session and refresh. The attacker loses access within seconds. This is always the first action.

Step 2: Force password reset. Entra ID, User, Reset password. The proxy captured credentials in addition to the token. Without a password reset, the attacker could sign in again with the stolen password after revocation.

Step 3: Force MFA re-registration. Entra ID, User, Authentication methods, Require re-register MFA. If the attacker registered their own phone or authenticator app during the 25-minute access window, this removes all registered methods and forces the legitimate user to re-register from a known clean device.

Step 4: Remove malicious inbox rules. Document the rule first (screenshot plus details for the incident report), then delete it via Exchange admin centre or PowerShell. The “Security notifications” rule created at 09:25 is actively hiding compromise evidence from the user.

Step 5: Verify no mail forwarding. Check ForwardingSmtpAddress and ForwardingAddress on the mailbox. Check inbox rules with redirect or forward actions. Check transport rules matching this user. Result: clean.

Step 6: Verify no OAuth grants. Check AuditLogs for “Consent to application” events. OAuth grants persist beyond session revocation. If the attacker granted a malicious app access to the mailbox, that app retains access even after password reset. Result: clean.

Step 7: Contact user by phone. Call the user directly to a verified number. Do NOT use email (the inbox rule may still be active or forwarding may exist that you missed). Do NOT use Teams (the attacker may still have access to other M365 apps if revocation has not fully propagated). Phone call is the only secure channel.

Containment verification query

After completing all 7 steps, verify the attacker no longer has access:

1
2
3
4
5
6

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1h)
| where UserPrincipalName =~ "j.morrison@northgateeng.com"
| where IPAddress == "203.0.113.45"
| project TimeGenerated, ResultType, AppDisplayName, IPAddress
| sort by TimeGenerated desc

Expected result: no new events from the attacker IP, or events with ResultType != 0 (token rejected). If you see successful events after revocation, containment failed. Escalate immediately.

Timeline

Total containment time: 8 minutes from investigation start. The 25-minute attacker access window (09:17 click to 09:42 revocation) includes the triage and investigation time. In a mature SOC with pre-built playbooks, this window can be reduced to under 10 minutes.