Compromise Recovery

Compromise Recovery

Compromise recovery is the disciplined process of regaining administrative control of an environment during or after a significant breach, evicting the adversary in a single coordinated action, and re-establishing a trustworthy security posture so the attacker cannot return.

When to use

Responding to a confirmed widespread compromise - tenant-wide Entra/AD compromise, ransomware, persistent adversary with Global Admin or Domain Admin - where normal remediation is insufficient and the existing infrastructure cannot be trusted.

Do not use this skill for:

• Routine alert triage or single-host malware (use defender-xdr)
• Pre-incident architecture hardening (use security-architecture, entra-id, paw-design)
• Sentinel hunting and detection engineering (use sentinel)

Decide what stage you are at

Rule of thumb: Never start eviction from the compromised environment. Stand up a trusted foundation first - dedicated admin workstations (PAW), out-of-band communications, a clean Entra tenant or cleanly-rebuilt admin accounts. Acting from untrusted infrastructure hands the adversary your response plan in real time.

Approach

1. Engage qualified incident responders immediately - For major incidents, engage Microsoft Incident Response or a qualified DFIR partner. The cost of delay (re-entry, ransomware double-extortion, regulator timelines) dwarfs the engagement cost. Verify: an IR partner is engaged within the first 24 hours of confirmed compromise.
2. Establish a trusted foundation - Stand up out-of-band communications (separate Teams tenant, signal/voice), secure admin devices (PAWs), and a clean admin identity path. Assume existing infrastructure - mail, chat, jump hosts, admin accounts - may be untrusted or monitored by the adversary. Verify: incident bridge is on out-of-band channel; responders authenticate from PAW or equivalent isolated workstation; no compromised admin account is used.
3. Preserve forensic evidence before remediating - Snapshot affected systems, export sign- in logs, audit logs, mail items, and Entra/AD changes. Once you remediate you lose evidence; regulators and insurers will ask for it. Verify: forensic acquisitions are stored on isolated, write-protected media with chain of custody documented.
4. Contain without tipping off - Limit the adversary's ability to act: protect crown jewels (privileged accounts, federation/signing keys, backup credentials), tighten Conditional Access in stealth mode where possible, monitor known adversary accounts without blocking them yet. Partial eviction warns the adversary and invites re-entrenchment under a new identity. Verify: containment actions are recorded in a sequenced runbook, not ad-hoc; nothing visible to the adversary has changed unless deliberate.
5. Evict in a single coordinated action - Plan a sequenced removal across all known persistence: compromised accounts (disable + reset), app registrations and consent grants (review and revoke), mailbox rules and forwarding (delete), scheduled tasks / startup items, golden/forged Kerberos tickets, federation/SAML tokens, any added admin roles. Aim for one decisive action window rather than piecemeal changes. Verify: an eviction runbook lists every persistence artefact with owner, time, and verification step; rehearsed before execution.
6. Reset identity trust - Reset the krbtgt account (twice, with sufficient interval for replication), reset all privileged credentials, rotate federation/SAML signing certificates, rotate Entra Connect sync account, and reset any service principal secrets the adversary could have touched. Verify: krbtgt reset is logged twice; federation cert rollover is complete; sign-in logs show no remaining sessions from compromised tokens.
7. Harden to prevent reentry - Enforce phishing-resistant MFA on all privileged and high-risk users, move privileged roles into PIM with just-in-time activation and approvals, deploy or expand PAW for admin work, expand Defender + Sentinel monitoring with detections tuned to the observed adversary TTPs, and apply the least privilege model across the privileged tier. Verify: 100% of privileged accounts in PIM and behind phishing-resistant MFA; named PAW estate for admin work; new detections deployed for the specific TTPs seen.
8. Transition to BAU - Hand off to a sustained security operations and improvement programme with a 90-day watch period, a documented lessons-learned, and committed investment in the gaps that allowed initial compromise.