compromise-recovery

Name: compromise-recovery
Author: vinayaklatthe

53installs34forks

How to install compromise-recovery?

vinayaklatthe/microsoft-security-skills/compromise-recovery

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill compromise-recovery

Installs into the current project.

Summary

Guidance for responding to and recovering from a significant identity/tenant compromise - regaining administrative control, evicting the adversary in a single coordinated action, and hardening to prevent reentry. Covers trusted foundation (PAW), containment, eviction, identity re

Files · 1

View on GitHub

SKILL.md

1	# Compromise Recovery
2
3	Compromise recovery is the disciplined process of regaining administrative control of an
4	environment during or after a significant breach, **evicting the adversary in a single
5	coordinated action**, and re-establishing a trustworthy security posture so the attacker
6	cannot return.
7
8	## When to use
9	Responding to a confirmed widespread compromise - tenant-wide Entra/AD compromise, ransomware,
10	persistent adversary with Global Admin or Domain Admin - where normal remediation is
11	insufficient and the existing infrastructure cannot be trusted.
12
13	Do not use this skill for:
14	- Routine alert triage or single-host malware (use `defender-xdr`)
15	- Pre-incident architecture hardening (use `security-architecture`, `entra-id`, `paw-design`)
16	- Sentinel hunting and detection engineering (use `sentinel`)
17
18	## Decide what stage you are at
19
20	\| Situation \| Stage \| First action \|
21	\|---\|---\|---\|
22	\| Anomalies detected, not yet confirmed scope \| Investigate \| Hunt + preserve evidence, do not tip off \|
23	\| Adversary confirmed, scope still expanding \| Contain \| Stand up trusted foundation (PAW), protect crown jewels \|
24	\| Adversary scope known, ready to remove \| Evict \| Single coordinated action across all persistence \|
25	\| Adversary removed, validating no re-entry \| Recover \| Reset krbtgt, federation secrets, privileged creds \|
26	\| Stable, hardening to prevent recurrence \| Harden \| MFA-everywhere, PIM, PAW, monitoring expansion \|
27	\| Hardening complete, back to BAU \| Transition \| Hand off to sustained SecOps + improvement \|
28
29	> Rule of thumb: Never start eviction from the compromised environment. Stand up a
30	> trusted foundation first - dedicated admin workstations (PAW), out-of-band communications,
31	> a clean Entra tenant or cleanly-rebuilt admin accounts. Acting from untrusted infrastructure
32	> hands the adversary your response plan in real time.
33
34	## Approach
35
36	1. Engage qualified incident responders immediately - For major incidents, engage Microsoft
37	Incident Response or a qualified DFIR partner. The cost of delay (re-entry, ransomware
38	double-extortion, regulator timelines) dwarfs the engagement cost.
39	Verify: an IR partner is engaged within the first 24 hours of confirmed compromise.
40	2. Establish a trusted foundation - Stand up out-of-band communications (separate Teams
41	tenant, signal/voice), secure admin devices (PAWs), and a clean admin identity path.
42	Assume existing infrastructure - mail, chat, jump hosts, admin accounts - may be untrusted
43	or monitored by the adversary.
44	*Verify: incident bridge is on out-of-band channel; responders authenticate from PAW or
45	equivalent isolated workstation; no compromised admin account is used.*
46	3. Preserve forensic evidence before remediating - Snapshot affected systems, export sign-
47	in logs, audit logs, mail items, and Entra/AD changes. Once you remediate you lose
48	evidence; regulators and insurers will ask for it.
49	*Verify: forensic acquisitions are stored on isolated, write-protected media with chain of
50	custody documented.*
51	4. Contain without tipping off - Limit the adversary's ability to act: protect crown
52	jewels (privileged accounts, federation/signing keys, backup credentials), tighten
53	Conditional Access in stealth mode where possible, monitor known adversary accounts without
54	blocking them yet. Partial eviction warns the adversary and invites re-entrenchment
55	under a new identity.
56	*Verify: containment actions are recorded in a sequenced runbook, not ad-hoc; nothing
57	visible to the adversary has changed unless deliberate.*
58	5. Evict in a single coordinated action - Plan a sequenced removal across all known
59	persistence: compromised accounts (disable + reset), app registrations and consent grants
60	(review and revoke), mailbox rules and forwarding (delete), scheduled tasks / startup
61	items, golden/forged Kerberos tickets, federation/SAML tokens, any added admin roles. Aim
62	for one decisive action window rather than **p

People who liked this also viewed

6 picks

Type

compromise-recovery

53installs34forks

View on GitHub

How to install compromise-recovery?

vinayaklatthe/microsoft-security-skills/compromise-recovery

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill compromise-recovery

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Compromise Recovery
2
3	Compromise recovery is the disciplined process of regaining administrative control of an
4	environment during or after a significant breach, **evicting the adversary in a single
5	coordinated action**, and re-establishing a trustworthy security posture so the attacker
6	cannot return.
7
8	## When to use
9	Responding to a confirmed widespread compromise - tenant-wide Entra/AD compromise, ransomware,
10	persistent adversary with Global Admin or Domain Admin - where normal remediation is
11	insufficient and the existing infrastructure cannot be trusted.
12
13	Do not use this skill for:
14	- Routine alert triage or single-host malware (use `defender-xdr`)
15	- Pre-incident architecture hardening (use `security-architecture`, `entra-id`, `paw-design`)
16	- Sentinel hunting and detection engineering (use `sentinel`)
17
18	## Decide what stage you are at
19
20	\| Situation \| Stage \| First action \|
21	\|---\|---\|---\|
22	\| Anomalies detected, not yet confirmed scope \| Investigate \| Hunt + preserve evidence, do not tip off \|
23	\| Adversary confirmed, scope still expanding \| Contain \| Stand up trusted foundation (PAW), protect crown jewels \|
24	\| Adversary scope known, ready to remove \| Evict \| Single coordinated action across all persistence \|
25	\| Adversary removed, validating no re-entry \| Recover \| Reset krbtgt, federation secrets, privileged creds \|
26	\| Stable, hardening to prevent recurrence \| Harden \| MFA-everywhere, PIM, PAW, monitoring expansion \|
27	\| Hardening complete, back to BAU \| Transition \| Hand off to sustained SecOps + improvement \|
28
29	> Rule of thumb: Never start eviction from the compromised environment. Stand up a
30	> trusted foundation first - dedicated admin workstations (PAW), out-of-band communications,
31	> a clean Entra tenant or cleanly-rebuilt admin accounts. Acting from untrusted infrastructure
32	> hands the adversary your response plan in real time.
33
34	## Approach
35
36	1. Engage qualified incident responders immediately - For major incidents, engage Microsoft
37	Incident Response or a qualified DFIR partner. The cost of delay (re-entry, ransomware
38	double-extortion, regulator timelines) dwarfs the engagement cost.
39	Verify: an IR partner is engaged within the first 24 hours of confirmed compromise.
40	2. Establish a trusted foundation - Stand up out-of-band communications (separate Teams
41	tenant, signal/voice), secure admin devices (PAWs), and a clean admin identity path.
42	Assume existing infrastructure - mail, chat, jump hosts, admin accounts - may be untrusted
43	or monitored by the adversary.
44	*Verify: incident bridge is on out-of-band channel; responders authenticate from PAW or
45	equivalent isolated workstation; no compromised admin account is used.*
46	3. Preserve forensic evidence before remediating - Snapshot affected systems, export sign-
47	in logs, audit logs, mail items, and Entra/AD changes. Once you remediate you lose
48	evidence; regulators and insurers will ask for it.
49	*Verify: forensic acquisitions are stored on isolated, write-protected media with chain of
50	custody documented.*
51	4. Contain without tipping off - Limit the adversary's ability to act: protect crown
52	jewels (privileged accounts, federation/signing keys, backup credentials), tighten
53	Conditional Access in stealth mode where possible, monitor known adversary accounts without
54	blocking them yet. Partial eviction warns the adversary and invites re-entrenchment
55	under a new identity.
56	*Verify: containment actions are recorded in a sequenced runbook, not ad-hoc; nothing
57	visible to the adversary has changed unless deliberate.*
58	5. Evict in a single coordinated action - Plan a sequenced removal across all known
59	persistence: compromised accounts (disable + reset), app registrations and consent grants
60	(review and revoke), mailbox rules and forwarding (delete), scheduled tasks / startup
61	items, golden/forged Kerberos tickets, federation/SAML tokens, any added admin roles. Aim
62	for one decisive action window rather than **p

People who liked this also viewed

6 picks

Type