ChecklistCONSTRUCTEDUntested

First 15 minutes: a user typed their password into a phishing page

Assume the session was taken, not just the password. Revoke first, find everybody else the email reached, and check what the attacker did with the time they had.

high severityInitial AccessT1566.002T1557T1078.004

The clock starts when

A user reports that they entered their password, or approved an MFA prompt, on a page they reached from a link in an email or message.

0 of 9 done

minutes 0 to 5

Assume the session is gone, not only the password

Revoke all the user's sessions and refresh tokens, then reset the password.Current phishing kits relay the real login and keep the session cookie, so MFA was probably satisfied for the attacker as well.
Check sign-ins for the account since the click, especially from addresses the user has never used.
Get the message itself from the mail gateway or the user: sender, subject, links and headers.

minutes 5 to 10

Stop the next person

Search all mailboxes for the same sender, subject or link, and remove the message everywhere.Campaigns go to many people. The report in front of you is usually the first, not the only one.
Block the link's domain at the web proxy and the mail gateway.
Find who else visited it: proxy or DNS logs for the domain since the message arrived.expires

minutes 10 to 15

Check what the session did

Look for new inbox rules, forwarding, MFA methods, registered devices and app consents on the account.Each of those outlives the password reset. They are how the attacker stays.
Check the account's sent mail in message trace for phishing sent onward to colleagues.Internal phishing from a trusted sender works far better than the original lure.
Thank the user, and tell them what happens next.A fast report is the control that worked. The next one depends on how this one was received.

Do not

Do not only reset the password. A stolen session cookie does not need it.
Do not open the phishing link from a normal workstation. Use an isolated sandbox, and know that some public scanners publish what you submit.
Do not wait for other users to report it before searching for the message.

Escalate now if

Sign-ins from an unfamiliar address succeeded after the click.
The account is privileged, in finance, or belongs to an executive.
More than a handful of users received or clicked it.
Inbox rules, forwarding or app consents were created.

Minute sixteen. The checklist ends here and the response does not.

Open the phishing playbook

Why this order

The old version of this incident was a stolen password, and a reset ended it. The current version, built on kits that sit between the user and the real login page, takes the session as well. The attacker is signed in with MFA already satisfied, and the reset alone does not throw them out. Revoking sessions first is what closes that.

The second five minutes are about everybody else. One user reporting a phish is good news, and it is almost never the only user who received it.

What this does not cover

A compromise that has already been used, with rules, consents or new MFA methods in place. If the last window turns any of those up, move to the account compromise material rather than finishing this list.

sources

Tags: first-15 · phishing · credentials · aitm · identity · email · T1566.002