☁️ Cloud & Identity Compromise
Unauthorized access to cloud infrastructure or identity provider through stolen tokens, OAuth abuse, or misconfigured access policies.
25 procedures8 lifecycle stages
Triage
(3 procedures)Containment
(2 procedures)Credential and Account Lockdown
Account Lockdown
45min
View procedure
Revoke Cloud Sessions and Tokens
Revoke Cloud Sessions
30min
View procedure
Sponsored
Preservation
(4 procedures)Collection
(5 procedures)EDR Telemetry Collection
EDR Collection
120min
View procedure
M365 Unified Audit Log Collection
M365 UAL Collection
90min
View procedure
Azure AD Sign-In and Audit Log Collection
Azure AD Logs
60min
View procedure
Identify Alternative Evidence When Primary Logs Are Missing
Missing Log Fallback
60min
View procedure
Coordinate Log Collection from Third-Party Vendors
Third-Party Logs
120min
View procedure
Analysis
(3 procedures)Eradication
(4 procedures)Mass Credential Reset and Session Invalidation
Credential Reset
90min
View procedure
Comprehensive Persistence Mechanism Sweep
Persistence Hunt
120min
View procedure
Eradication Verification Checklist
Eradication Verification
90min
View procedure
Post-Incident Configuration Hardening
Config Hardening
180min
View procedure