The 15-Minute Phish Response Runbook

By Grant Sullivan (Lead Writer) | Digital Forensics & Incident Response: Trevor Donovan | Identity Security: Hannah Bishop | CISO Review: Katherine Hughes

FRONTLINE INCIDENT TRIAGE & FIRST-RESPONDER CHEATSHEET
– Threat Vector: AiTM phishing, session cookie theft, credential harvesting, MFA fatigue
– Initial Blast Radius: Compromised user session tokens, Entra ID persistence, lateral mailbox access
– Emergency First Action: Revoke active user sessions and reset credentials within 15 minutes
– Quarantine Command: Isolate device from network via EDR or Intune remote action
– Escalation Path: Frontline triage -> Tier-2 security analyst -> Incident Commander

The Anatomy of Modern AiTM Phishing Attacks

Modern phishing attacks have evolved far beyond crude credential harvesting forms. Contemporary threat actors deploy Adversary-in-the-Middle (AiTM) phishing frameworks, such as Evilginx and Modlishka, acting as transparent reverse proxies between the victim and legitimate enterprise identity providers like Microsoft Entra ID or Google Workspace.

When an employee interacts with an AiTM phishing link, the proxy captures both plaintext credentials and the authentication handshake in real time. Once the user satisfies multi-factor authentication (MFA), whether via SMS, email OTP, or authenticator push approval, the proxy intercepts the resulting session cookies (specifically ESTSAUTH and ESTSAUTHPERSISTENT).

With session tokens captured, adversaries can replay them from any workstation without ever knowing the user’s password or triggering additional MFA prompts. The blast radius expands rapidly: threat actors establish persistence, register rogue OAuth applications, configure silent email forwarding rules, and commence internal lateral reconnaissance. The window to prevent widespread tenant takeover is narrow, measured strictly in minutes.

The 15-Minute First-Responder Runbook for Phishing Incidents

When an employee alerts IT that they clicked a suspicious link or entered credentials on an unrecognized portal, responders must execute an immediate, disciplined sequence of containment actions.

Phase 1: Verification and Network Disconnect (0 to 2 Minutes)

• Secure User Contact: Contact the reporting employee immediately via an out-of-band communication channel (direct corporate phone extension or verified voice/video call). Never communicate solely via email, as the inbox may already be actively monitored by an attacker.
• Rapid Triage Questions:
  • What exact URL was visited or clicked?
  • Were credentials or MFA approval codes supplied?
  • Were any attachments downloaded or executed?
  • Is unusual inbox activity (such as unexpected delivery receipts or new folders) visible?
• Immediate Network Isolation: Instruct the user to disconnect their workstation from local networks immediately by disabling Wi-Fi and unplugging Ethernet cables.

Phase 2: Session Invalidation and Credential Reset (2 to 5 Minutes)

• Revoke All Active User Sessions: This is the single most critical immediate action. Terminating all active refresh tokens and session cookies invalidates adversary proxy access across all browsers and devices:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
$UserPrincipalName = "user.name@yourdomain.com"
$TargetUserId = (Get-MgUser -UserPrincipalName $UserPrincipalName).Id
Revoke-MgUserSignAndSession -UserId $TargetUserId
Write-Host "All active sessions revoked for $UserPrincipalName."

• Force Password Reset: Reset the account password and mark the credential as requiring a change upon subsequent login:

Update-MgUser -UserId $TargetUserId -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
    Password = "TemporaryComplexPassword123!"
}

• Enforce Temporary Account Block: If forensic analysis requires further examination or the user cannot be verified out-of-band, disable the account temporarily:

Update-MgUser -UserId $TargetUserId -AccountEnabled $false

Phase 3: Endpoint Quarantine and Persistence Sweep (5 to 10 Minutes)

• Isolate Endpoint via EDR or Intune: Use your Endpoint Detection and Response (EDR) platform (such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) to quarantine the physical workstation from the enterprise network while preserving telemetry connectivity.
• Audit Malicious Inbox Rules: Adversaries routinely inject silent forwarding rules to exfiltrate email or hide response communications:

Connect-ExchangeOnline -UserPrincipalName "admin@yourdomain.com"
Get-InboxRule -Mailbox "user.name@yourdomain.com" | Select-Object Name, Description, Enabled, ForwardTo, RedirectTo

*Delete any unapproved forwarding or redirect rules immediately using `Remove-InboxRule`.*

• Audit OAuth App Grants: Inspect Entra ID app consent grants to ensure the attacker did not authorize third-party enterprise applications to maintain persistent Graph API access:

Get-MgUserOauth2PermissionGrant -UserId $TargetUserId | Select-Object ClientId, Scope, ConsentType

Phase 4: Forensic Escalation and Logging (10 to 15 Minutes)

• Escalate with Artifacts: Package collected artifacts (phishing URLs, headers, timestamps, and target UPN) and transfer the ticket to Tier-2 Security Operations or the Incident Commander.
• Inspect Sign-In Telemetry: Review Entra ID Sign-In logs for anomalous IP addresses, non-compliant device states, unfamiliar user-agent strings, and impossible travel velocity.
• Document Timeline: Record all actions, timestamps, and containment steps directly in the central ITSM ticketing platform for compliance and post-incident auditing.

Defensive Identity Hardening: Phishing-Resistant Controls

To prevent session interception and mitigate the impact of phishing campaigns across the enterprise, security leaders must enforce technical controls that resist proxy-based harvesting:

• Phishing-Resistant MFA (FIDO2 & Passkeys): Traditional push notifications and SMS OTPs are inherently vulnerable to AiTM relay attacks. Enforce FIDO2 hardware security keys, Windows Hello for Business, or passkeys bound to device hardware. These protocols cryptographicly tie authentication to the legitimate domain URL, completely defeating reverse-proxy interception.
• Continuous Access Evaluation (CAE): Enable Microsoft Entra Continuous Access Evaluation. CAE terminates access tokens in near real time (within minutes) when critical events occur, such as user revocation, password resets, or location anomalies.
• Conditional Access Authentication Strengths: Require phishing-resistant authentication strengths for all privileged administrative roles, high-risk access policies, and sensitive cloud workloads.
• Automated Risk-Based Remediation: Implement automated Entra ID Identity Protection policies that force password resets and session revocation automatically whenever user or sign-in risk reaches “High”.

Sources & References

• Canadian Centre for Cyber Security. “Top 10 IT Security Actions: Protect Your Organization (ITSAP.00.101).” Government of Canada.
• CISA. “Implementing Phishing-Resistant Multi-Factor Authentication.” Cybersecurity & Infrastructure Security Agency.
• MITRE ATT&CK. “T1566.002: Phishing – Spearphishing Link.” MITRE Corporation.
• Microsoft Learn. “Revoke-MgUserSignAndSession Command Reference.” Microsoft Corporation.