Cloud account takeover recovery steps

Overview

Account takeover in Microsoft 365, AWS, or Azure often starts with phishing, MFA fatigue, or token theft from an unmanaged device. Recovery means evicting the attacker from the identity plane, not only changing one password.

Immediate

• Revoke active sessions and sign-in refresh tokens (Entra ID, AWS IAM, etc.).
• Reset credentials for compromised users and adjacent admins if coordinated takeover is suspected.
• Review mailbox rules, forwarding, OAuth application grants, new global admins, and break-glass account use.

Hunting

• Mine unified audit logs or CloudTrail for privileged creations, policy attachment, risky storage bucket changes, and unfamiliar regions.
• Rotate application registration secrets that may have been exposed.

Containment

• Apply emergency Conditional Access policies (block legacy auth, tighten location or device compliance) with executive sign-off if travelers are affected.
• Block scripted mass-forwarding or PowerShell activity patterns your IR team has identified.

Recovery

• Restore purged mailbox items within the soft-delete window after legal preservation guidance.
• Revert malicious infrastructure-as-code changes or Terraform state drift with version control and peer review.

Posture afterward

• Enforce phishing-resistant MFA for privileged roles and break-glass monitoring on every use.
• Communicate honestly with the sponsor about delays while mailboxes and audit logs are reviewed—transparency supports trust repair.

Metrics

Track hours from first alert to confirmed eviction and watch for repeat compromise within the next quarter.