13.8 Eradication and Verification

Eradication and Verification

Containment stopped the attacker. Eradication confirms every persistence mechanism is removed and the environment is clean. Verification confirms containment is holding over time.

Eradication checklist

Run each query and confirm the expected clean result:

1. Confirm no remaining inbox rules from the attacker:

1
2
3
4
5
6

CloudAppEvents
| where TimeGenerated > ago(7d)
| where AccountDisplayName has "morrison"
| where ActionType in ("New-InboxRule", "Set-InboxRule")
| where IPAddress != "198.51.100.10"
| project TimeGenerated, ActionType, IPAddress, tostring(RawEventData.Parameters)

Replace 198.51.100.10 with the user’s known corporate IP. Any results from unknown IPs indicate additional rules you missed.

2. Confirm no delegate access was granted:

1
2
3
4
5

CloudAppEvents
| where TimeGenerated > ago(7d)
| where ActionType in ("Add-MailboxPermission", "Add-RecipientPermission")
| where tostring(RawEventData.Parameters) has "morrison"
| project TimeGenerated, ActionType, tostring(RawEventData.Parameters), IPAddress

Attackers sometimes grant delegate access to another mailbox they control, creating persistent access without needing the compromised user’s credentials.

3. Confirm no new MFA methods registered by the attacker:

1
2
3
4
5

AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any ("User registered security info", "User registered all required security info", "Admin registered security info")
| where TargetResources has "morrison"
| project TimeGenerated, OperationName, tostring(InitiatedBy), tostring(AdditionalDetails)

After forcing MFA re-registration, you should see only the legitimate user re-registering from their known device.

Monitoring for re-compromise

Set up a temporary monitoring window. For the next 7 days, run this query daily:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

let watch_users = dynamic(["j.morrison@northgateeng.com"]);
let watch_start = datetime(2026-02-27T09:50:00Z);
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > watch_start
| where UserPrincipalName in~ (watch_users)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| where Country != "GB"
| project TimeGenerated, UserPrincipalName, IPAddress, Country, AppDisplayName, Type
| sort by TimeGenerated desc

Any successful sign-in from outside the UK during the monitoring window triggers immediate re-investigation. The attacker may attempt to re-compromise the user via a different method (credential replay, SIM swap, social engineering of the help desk).

Verification sign-off

This checklist is your sign-off document. Every “Confirmed” should have a corresponding query result (screenshot or CSV export) in your evidence file.