Lesson 96 — The Executive Account Was Compromised
The sign-in was suspicious.
The session succeeded.
Then you checked the user's role.
Chief Financial Officer.
Same technique. Very different potential impact.
Investigate the evidence while accounting for privileged business access and escalation requirements.
Case briefing
Investigation objective
Investigate a compromised executive identity, determine what the account could access, contain active attacker access and escalate according to evidence and business impact.
Investigator's rule
Do not change the evidence because the user is important. Change the urgency because the impact may be.
Stage 1 — establish identity context
| Context | Why it matters |
|---|---|
| Executive role | Potential access to sensitive business information |
| Finance responsibilities | Possible exposure to payments, forecasts and transactions |
| Broad communication access | Mailbox may contain sensitive internal discussions |
| Trusted organisational identity | Account may be useful for impersonation or fraud |
Role is context, not proof
An executive title does not make an alert malicious. Validate the sign-in and session using the same evidence-led process you would use for any identity.
Impact can alter priority
Once compromise is supported, access to sensitive systems, information and business processes can justify faster escalation.
Stage 2 — review the sign-in timeline
let User = "cfo@contoso.com";
EntraIdSignInEvents
| where Timestamp > ago(4h)
| where AccountUpn =~ User
| project Timestamp,
AccountUpn,
IPAddress,
Country,
Application,
ErrorCode
| order by Timestamp ascValidate success and context
Determine whether authentication succeeded and whether the IP address, location, application and timing fit the executive's expected activity.
Do not let status distort analysis
Investigators should neither dismiss unusual activity because the user travels frequently nor assume compromise merely because the account is high profile.
Stage 3 — reconstruct post-authentication activity
Ask what the attacker did
Once access is established, investigate mailbox, SharePoint, OneDrive and other cloud activity to determine the purpose and impact of the session.
Look for persistence and fraud preparation
Mailbox rules, forwarding, unusual consent, authentication changes or other persistence mechanisms can extend attacker access or support impersonation.
Stage 4 — review cloud actions
let User = "cfo@contoso.com";
CloudAppEvents
| where Timestamp > ago(4h)
| where AccountId =~ User
| project Timestamp,
AccountId,
Application,
ActionType,
IPAddress,
ObjectName
| order by Timestamp ascPrioritise high-impact actions
Access to financial documents, sensitive correspondence, payment information or strategic material can materially change the incident impact.
Look for actions that enable deception
An attacker controlling an executive mailbox may attempt internal impersonation, payment redirection or trusted-message phishing.
Stage 5 — assess the blast radius
| Question | Why ask it? |
|---|---|
| What sensitive data was accessed? | Determine exposure and business impact |
| Were messages sent? | Identify impersonation or phishing |
| Were mailbox rules changed? | Identify persistence or concealment |
| Were finance systems accessed? | Assess fraud or transaction risk |
| Were other identities targeted? | Determine whether compromise expanded |
Think beyond the account
The blast radius includes people who trust the executive, systems the executive can reach and business processes that accept their authority.
Technical privilege is not the only privilege
An executive may have no administrator role but still possess significant organisational authority and access to high-value information.
Stage 6 — containment
Contain active access quickly
Where evidence supports active compromise, response should prevent continued attacker access while preserving the information needed to understand the incident.
Coordinate disruptive actions
Executive accounts can be operationally important. Containment may require rapid coordination so security actions occur without unnecessary delay or confusion.
Stage 7 — escalation
Escalate the facts
State what is known, what remains unknown, what has been contained and what business risks require attention.
Avoid executive panic
High-impact escalation should be controlled and evidence-based. Seniority increases potential impact; it does not justify speculation.
Stage 8 — preserve business evidence
| Evidence | Purpose |
|---|---|
| Sign-in history | Establish authentication timeline |
| Cloud audit activity | Establish accessed resources and actions |
| Mailbox changes | Identify persistence or concealment |
| Sent messages | Identify impersonation attempts |
| Finance-system activity | Assess transaction or fraud exposure |
Preserve before cleaning up
Where operationally possible, capture the evidence required to explain the attack before remediation removes rules, sessions or other artefacts.
Business teams may hold evidence too
Finance, legal, executive support and other stakeholders may have information needed to determine whether suspicious requests or transactions occurred.
Stage 9 — incident finding
State potential impact carefully
Potential fraud is not confirmed fraud. Distinguish observed activity from plausible business consequences that still require investigation.
Make the handover actionable
Anyone receiving the escalation should understand the current evidence, containment status, unresolved risks and next investigative actions.
Decision point
Evidence first, urgency second
The same investigation principles still apply. What changes is how quickly the organisation may need to act once the account's business context is understood.
The incident story continues
The loudest security event may still be ahead. Lesson 97 examines a ransomware alert that turns out to be only the middle of a much longer attack timeline.
Lesson 96 key takeaways
- Executive status does not prove compromise.
- Validate authentication and post-authentication activity using evidence.
- Business role can materially change incident impact and priority.
- Technical privilege is not the only form of valuable access.
- Review mailbox, cloud data and business-system activity after compromise.
- Look for persistence, concealment and impersonation behaviour.
- Consider fraud and payment-process exposure without assuming loss occurred.
- Contain active sessions, credentials and malicious account changes.
- Coordinate disruptive containment when the identity is operationally important.
- Escalate confirmed facts, unresolved questions and potential business impact.
- Preserve both technical and business evidence.
- High-impact incidents still require disciplined, evidence-led investigation.
Module 10 — Complete SOC Investigation Scenarios
Lesson 96 examined how executive identity compromise changes impact, containment and escalation. Lesson 97 reconstructs the activity surrounding a ransomware alert to discover what happened before and after the loudest event.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 10: Complete SOC Investigation Scenarios
How should a SOC investigate a compromised executive account?
Lesson 96 of the Agent Foskett SOC Analyst Academy investigates compromise of a high-impact executive identity and examines authentication, mailbox activity, sensitive cloud access, containment and escalation.
Executive account compromise and incident escalation
Learn how business context changes incident impact without changing the evidence standard, and how SOC analysts can contain active access, preserve evidence, assess fraud exposure and communicate a defensible escalation.
