CySA+ Runbook 02 — Suspicious Authentication Investigation

Runbook Information

Item	Details
Runbook	02
Runbook Name	Suspicious Authentication Investigation
Track	CompTIA CySA+
Difficulty	Intermediate
Primary Role	SOC Analyst / Cybersecurity Analyst
Purpose	Investigate suspicious authentication and determine whether credentials or user identities have been compromised
Primary Systems	SIEM, Windows, Linux, Identity Provider, VPN, Cloud Platforms, EDR
Primary Data Sources	Authentication Logs, Windows Security Logs, Linux Auth Logs, MFA Logs, VPN Logs, Identity Logs, Endpoint Telemetry
Output	Benign Activity / Suspicious Authentication / Confirmed Account Compromise / Escalation
Related Labs	Lab 02, Lab 04, Lab 08, Lab 09, Lab 10, Lab 17, Lab 20

Operational Principle: A failed login is not necessarily an attack, and a successful login is not necessarily legitimate. Authentication events must be evaluated using identity, source, device, privilege, timing, and behavioral context.

1. Purpose

This runbook provides a repeatable procedure for investigating suspicious authentication activity.

The analyst must determine:

Who authenticated?
      ↓
From where?
      ↓
To what system?
      ↓
When?
      ↓
How?
      ↓
Was authentication successful?
      ↓
Was MFA involved?
      ↓
Was the activity expected?
      ↓
What happened afterward?
      ↓
Is the identity compromised?

The objective is not simply to identify failed logins.

The objective is to determine whether unauthorized access occurred.

2. When to Use This Runbook

Use this runbook for alerts involving:

• repeated authentication failures

• brute-force attempts

• password spraying

• credential stuffing

• successful login after repeated failures

• unusual source IP addresses

• unusual geographic locations

• unexpected devices

• privileged authentication

• service-account anomalies

• unusual VPN authentication

• MFA failures

• repeated MFA prompts

• unexpected MFA approvals

• disabled-account authentication

• unusual authentication times

• simultaneous or anomalous sessions

• suspicious remote-access activity

3. Expected Outcomes

Every investigation should reach one of these outcomes:

Authentication Alert
        ↓
Investigation
        ↓
├── False Positive
│
├── Benign Authentication
│
├── Suspicious Authentication
│
├── Confirmed Account Compromise
│
└── Inconclusive — Continue Monitoring / Escalate

4. Authentication Investigation Workflow

Use:

Alert Received
      ↓
Identify Identity
      ↓
Identify Source
      ↓
Identify Destination
      ↓
Analyze Failures
      ↓
Analyze Successful Logins
      ↓
Review MFA
      ↓
Review Device / Location
      ↓
Review Privilege
      ↓
Correlate Endpoint Activity
      ↓
Correlate Network Activity
      ↓
Search Related Accounts
      ↓
Determine Scope
      ↓
Assess Compromise
      ↓
Contain
      ↓
Escalate
      ↓
Document

5. Step 1 — Record the Authentication Alert

Capture the original alert before beginning investigation.

Record:

Case ID:

Alert ID:

Alert Name:

Detection Source:

Detection Time:

Username:

Source IP:

Destination:

Authentication Type:

Failure / Success:

MFA Status:

Original Severity:

Preserve the original event wherever possible.

6. Step 2 — Identify the User

Determine:

Username:

Display Name:

Account Type:

Department:

Role:

Privilege:

Normal Workstation:

Normal Applications:

Expected Working Hours:

Classify the account:

Standard User

Administrator

Privileged Administrator

Service Account

Application Account

Cloud Identity

Machine Account

Account type significantly affects risk.

7. Step 3 — Determine Account Criticality

Ask:

Can this account access sensitive information?

Can it administer systems?

Can it modify security controls?

Can it access cloud infrastructure?

Can it create users?

Can it access production?

Can it access backups?

Use:

Low

Medium

High

Critical

8. Step 4 — Identify the Source

Record:

Source IP:

Hostname:

Device:

Operating System:

Network:

VPN:

Geographic Context:

ASN / Provider:

Determine whether the source is:

Corporate Endpoint

VPN Address

Internal Server

Home Network

Cloud Provider

Hosting Provider

Unknown External Source

9. Step 5 — Identify the Destination

Determine what was accessed.

Examples:

Windows Endpoint

Domain Controller

Linux Server

VPN

Cloud Console

Web Application

Email

Administrative Portal

Remote Desktop Gateway

Record:

Destination Host:

Destination IP:

Application:

Service:

Port:

Environment:

Asset Criticality:

10. Step 6 — Establish the Investigation Window

Start around the alert.

Example:

Alert:
10:30

Initial Window:
09:30–11:30

Then expand backward and forward as required.

Look for activity occurring before the detection.

11. Step 7 — Review Failed Authentication

For Windows, commonly review:

Event ID 4625

For Linux:

grep -i "failed" /var/log/auth.log

or:

journalctl -u ssh

For other platforms, use the equivalent authentication telemetry.

Record:

Timestamp

Username

Source

Destination

Authentication Method

Failure Reason

Logon Type

12. Step 8 — Count Failed Attempts

Determine:

Number of Failures:

First Failure:

Last Failure:

Duration:

Source Count:

User Count:

Destination Count:

Patterns matter more than one isolated failure.

13. Step 9 — Identify Brute-Force Patterns

A brute-force pattern commonly resembles:

One Account
    ↓
Many Password Attempts
    ↓
Short Time Window

Example:

admin
 ↓
Fail
Fail
Fail
Fail
Fail
 ↓
Success

Investigate the successful login immediately.

14. Step 10 — Identify Password Spraying

Password spraying often resembles:

One Source
    ↓
user01 — Fail
user02 — Fail
user03 — Fail
user04 — Fail
user05 — Fail

The attacker attempts a small number of common passwords against many accounts.

Search the source IP across all identities.

15. Step 11 — Identify Credential Stuffing Indicators

Potential credential stuffing may involve:

Previously Compromised Credentials
        ↓
Multiple Login Attempts
        ↓
Different Accounts
        ↓
External Infrastructure

Look for:

• multiple targeted accounts

• automated request patterns

• known malicious infrastructure

• repeated authentication against internet-facing services

Do not classify credential stuffing without sufficient evidence.

16. Step 12 — Search for Successful Authentication

For Windows:

Event ID 4624

For Linux:

Accepted password

or:

Accepted publickey

Search specifically for success occurring after suspicious failures.

17. Step 13 — Correlate Failure-to-Success Sequences

A critical sequence is:

10:21 — Failure
10:22 — Failure
10:23 — Failure
10:24 — Failure
10:25 — Success

Ask:

Did the source remain the same?

Was the same account involved?

Was the destination the same?

Was MFA required?

What happened after the successful login?

18. Step 14 — Analyze Windows Logon Types

Relevant Windows logon types include:

Type	Description
2	Interactive
3	Network
4	Batch
5	Service
7	Unlock
8	Network Cleartext
9	New Credentials
10	Remote Interactive / RDP
11	Cached Interactive

The logon type helps determine how access occurred.

For example:

4624
+
Logon Type 10

may indicate a successful Remote Desktop session.

19. Step 15 — Review Failure Reasons

Failure reasons can help distinguish:

Incorrect Password

Unknown Username

Disabled Account

Expired Password

Account Restriction

Locked Account

For Windows, review fields such as:

Status

Sub Status

Do not rely solely on event count.

20. Step 16 — Investigate Privileged Authentication

Search:

Event ID 4672

where applicable.

Determine whether:

Special Privileges Assigned

occurred after suspicious authentication.

Record:

Username

Host

Timestamp

Source

Privilege Context

21. Step 17 — Distinguish Privilege Escalation

Do not automatically classify privileged activity as privilege escalation.

Determine whether:

Attacker gained additional privileges

or:

Compromised account was already privileged

These represent different attack paths.

22. Step 18 — Review MFA Activity

Investigate:

MFA Success

MFA Failure

MFA Denial

Repeated Prompts

Unexpected Approval

New MFA Registration

Authentication Method Change

Correlate MFA timestamps with login events.

23. Step 19 — Investigate MFA Fatigue Indicators

A suspicious pattern may resemble:

Login Attempt
      ↓
MFA Prompt
      ↓
Denied
      ↓
MFA Prompt
      ↓
Denied
      ↓
MFA Prompt
      ↓
Approved

This may indicate MFA push fatigue.

Contact the identity owner through approved organizational procedures when required.

24. Step 20 — Investigate MFA Method Changes

Look for:

New Authentication Device

New Phone

New Security Key

New Authenticator Registration

Recovery Method Change

Unexpected MFA registration can provide persistent identity access.

25. Step 21 — Review Geographic Context

Compare:

Current Source

with:

Known User Activity

Look for unusual:

Country

Region

City

Network Provider

Hosting Provider

Location alone does not prove compromise.

VPNs, mobile networks, proxies, and corporate gateways can alter apparent location.

26. Step 22 — Investigate Impossible or Improbable Travel

Example:

09:00
User authenticates from Location A

09:30
User authenticates from distant Location B

Investigate:

VPN Usage

Corporate Proxy

Mobile Network

Session Tokens

Source IP Accuracy

Authentication Method

Do not declare compromise based solely on geographic distance.

27. Step 23 — Review Device Context

Determine:

Is the device known?

Is it corporate-managed?

Has the user used it previously?

Is the OS expected?

Is the browser expected?

Is the device compliant?

Does EDR report it as healthy?

A new device plus unusual location plus privileged access significantly increases risk.

28. Step 24 — Review User-Agent Context

Where available, compare:

Browser

Operating System

Application

Client Version

against historical user activity.

User-Agent values can be spoofed, so treat them as supporting evidence.

29. Step 25 — Investigate VPN Authentication

Review:

VPN Login

Source IP

Assigned Internal IP

Username

Device

MFA

Session Start

Session End

A VPN session can explain later internal authentication.

Build:

External Source
      ↓
VPN Login
      ↓
Internal IP Assigned
      ↓
Internal Authentication

30. Step 26 — Investigate Remote Access

Look for:

RDP

SSH

VPN

WinRM

Remote Administration

Cloud Console

Remote Support Tools

Determine whether remote access was expected.

31. Step 27 — Correlate Endpoint Activity

After a suspicious successful login, search endpoint telemetry.

Look for:

Process Execution

PowerShell

Command Shell

New Files

Persistence

Security Tool Changes

Network Connections

The strongest evidence often appears after authentication.

32. Step 28 — Review Process Creation

For Windows, investigate:

Event ID 4688

where available.

Record:

Process

Parent Process

Command Line

User

Timestamp

Correlate with the login session.

33. Step 29 — Review PowerShell

Search:

Event ID 4104

where available.

Look for unexpected:

Encoded Activity

Downloads

Discovery

Administrative Commands

Security Changes

Do not execute commands discovered in logs.

34. Step 30 — Correlate Network Activity

Search the authenticated host in:

Firewall

Zeek

Suricata

DNS

Proxy

Look for activity following the login.

Example:

Suspicious Login
      ↓
PowerShell
      ↓
DNS Query
      ↓
External Connection

This greatly increases confidence of compromise.

35. Step 31 — Investigate Internal Authentication

Search whether the identity subsequently accessed:

Additional Endpoints

Servers

Domain Controllers

File Servers

Cloud Resources

Applications

This can reveal lateral movement.

36. Step 32 — Investigate Lateral Movement

Look for:

Source Host
      ↓
RDP / SMB / SSH / WinRM
      ↓
Destination Host
      ↓
Successful Authentication

Record:

Source

Destination

Identity

Protocol

Timestamp

Outcome

37. Step 33 — Investigate Service Accounts

Service accounts require different analysis.

Ask:

Does this account normally log in interactively?

Does it normally authenticate from this host?

Is this source expected?

Is this application expected?

Did the password recently change?

An interactive login by a non-interactive service account can be highly suspicious.

38. Step 34 — Investigate Machine Accounts

Machine accounts may appear as:

HOSTNAME$

Determine whether:

Source

Destination

Protocol

Timing

match expected machine behavior.

Do not treat machine-account authentication like human-user authentication.

39. Step 35 — Investigate Disabled Accounts

Authentication involving a disabled account may indicate:

Stale Credentials

Misconfigured Service

Unauthorized Attempt

Cached Authentication

Attacker Activity

Determine whether any authentication actually succeeded.

40. Step 36 — Investigate Dormant Accounts

Ask:

When was the account last legitimately used?

Why is it active now?

Was the user expected to return?

Has the account been reassigned?

Does the account retain privileges?

Dormant privileged accounts deserve special attention.

41. Step 37 — Investigate New Accounts

For Windows environments, review:

Event ID 4720

where relevant.

Determine:

Who created the account?

When?

On which system?

What privileges were assigned?

Unexpected account creation after suspicious authentication may indicate persistence.

42. Step 38 — Investigate Group Membership Changes

Look for changes involving privileged groups.

Examples include:

Administrators

Domain Admins

Enterprise Admins

Remote Desktop Users

Determine:

Account Added

Group

Actor

Timestamp

Source Host

43. Step 39 — Investigate Password Changes

Review unexpected:

Password Reset

Password Change

Administrative Password Reset

Determine:

Whose password changed?

Who changed it?

When?

Was the action expected?

44. Step 40 — Investigate Account Lockouts

Repeated authentication failures may trigger:

Account Lockout

For Windows, relevant environments may record:

Event ID 4740

Determine:

Account

Source

Time

Frequency

Account lockout alone does not prove attack activity.

45. Step 41 — Investigate Session Activity

Determine:

Session Start

Session Duration

Session End

Source

Destination

Actions Performed

Look for suspicious sessions that remain active.

46. Step 42 — Investigate Token or Session Abuse

Some identity attacks may not produce repeated password authentication.

Investigate evidence of:

Unexpected Session

Token Reuse

Session from New Source

Session Continuing After Password Reset

Unusual Cloud/API Activity

Identity containment may require session revocation in addition to password reset.

47. Step 43 — Search the Source IP Across Users

Pivot:

Source IP
   ↓
All Authentication Events

Determine whether the source targeted:

One Account

or:

Many Accounts

This can distinguish targeted credential compromise from broader spraying activity.

48. Step 44 — Search the User Across Sources

Pivot:

Username
   ↓
All Source IPs

Determine:

Normal Sources

New Sources

Concurrent Sources

Unexpected Infrastructure

49. Step 45 — Search the User Across Systems

Pivot:

Username
   ↓
All Destinations

Determine whether the account accessed:

One Endpoint

Multiple Endpoints

Servers

Cloud Platforms

Critical Systems

This helps establish identity scope.

50. Step 46 — Enrich Suspicious Source IPs

Use approved threat-intelligence sources.

Record:

IP:

ASN:

Provider:

Country:

Hosting / Residential:

Reputation:

Associated Activity:

Confidence:

Treat threat intelligence as context, not proof.

51. Step 47 — Identify Related Alerts

Search for alerts involving:

Same User

Same Source IP

Same Destination

Same Device

Same Time Window

Look for:

Authentication Alert
      ↓
Endpoint Alert
      ↓
Malware Alert
      ↓
Network Alert

52. Step 48 — Build the Authentication Timeline

Create:

Time	Event	User	Source	Destination	Result
10:21	Login	user01	IP-A	VPN	Failed
10:22	Login	user01	IP-A	VPN	Failed
10:25	Login	user01	IP-A	VPN	Success
10:26	MFA	user01	IP-A	IdP	Approved
10:30	RDP	user01	VPN-IP	WIN01	Success
10:34	Process	user01	WIN01	N/A	Suspicious

Use actual evidence.

53. Step 49 — Build the Identity Attack Story

Example:

External Source
      ↓
Authentication Failures
      ↓
Successful Login
      ↓
MFA Approval
      ↓
VPN Session
      ↓
Internal Authentication
      ↓
Endpoint Activity
      ↓
Privilege Use
      ↓
Lateral Movement

Every transition must be supported by evidence.

54. Step 50 — Determine Whether Credentials Are Compromised

Use:

Confirmed

Strong evidence of unauthorized successful authentication
and subsequent malicious activity.

Suspected

Authentication is highly anomalous,
but unauthorized use cannot yet be conclusively established.

Not Compromised

Activity was validated as legitimate.

Unknown

Available evidence is insufficient.

55. Step 51 — Determine Identity Scope

Classify accounts:

Identity	Evidence	Status
user01	Unauthorized login	Confirmed Compromised
admin01	Related activity	Investigate
svc-backup	Source contacted	Monitor

Use:

Confirmed Compromised

Suspected Compromised

Targeted

Unaffected

Unknown

56. Step 52 — Determine Asset Scope

Classify:

Confirmed Compromised

Suspected Compromised

Authenticated / Accessed

Unaffected

Unknown

Do not automatically classify every authenticated system as compromised.

57. Step 53 — Assess Confidentiality Impact

Ask:

Could the identity access sensitive data?

Did the suspicious session access it?

Were credentials or secrets available?

Were files downloaded?

Was email accessed?

Were cloud resources accessed?

58. Step 54 — Assess Integrity Impact

Ask:

Were passwords changed?

Were accounts created?

Were group memberships modified?

Were configurations changed?

Was persistence established?

59. Step 55 — Assess Availability Impact

Ask:

Was the account locked?

Were services affected?

Were resources disabled?

Was business access interrupted?

60. Step 56 — Determine Severity

Low

Failed attempts only

No successful authentication

Low-value identity

No suspicious follow-on activity

Medium

Suspicious successful authentication

Limited account access

Compromise unconfirmed

High

Confirmed account compromise

Successful unauthorized access

Privileged identity involvement

Endpoint compromise

Lateral movement

Critical

Domain-wide privilege compromise

Multiple privileged identities

Widespread lateral movement

Critical cloud administrator compromise

Confirmed major data exposure

61. Step 57 — Determine Whether Immediate Containment Is Required

Contain quickly when:

Unauthorized session is active

Compromised privileged account exists

Attacker is moving laterally

Malicious activity follows authentication

Sensitive resources are being accessed

Additional identities are being targeted

62. Identity Containment Options

Depending on organizational authority:

Disable Account

Force Password Reset

Revoke Active Sessions

Invalidate Tokens

Reset MFA

Remove Unauthorized MFA Methods

Block Source IP

Restrict Conditional Access

Disable VPN Session

Rotate Exposed Credentials

Containment should address both:

Credentials
+
Sessions

63. Do Not Rely Only on Password Reset

A password reset may not terminate:

Existing Sessions

Tokens

Application Passwords

API Credentials

OAuth Grants

Authentication Cookies

Follow the capabilities of the affected identity platform.

64. Privileged Identity Response

For compromised privileged identities, consider:

Immediate Disablement

Session Revocation

Credential Rotation

MFA Reset

Privilege Review

Related Administrator Investigation

Endpoint Investigation

Secret Rotation

Enterprise IOC Hunt

Escalate urgently.

65. Service Account Response

Do not immediately disable critical service accounts without assessing operational impact.

Instead:

Identify Dependencies
      ↓
Contain Source
      ↓
Rotate Credential
      ↓
Update Dependent Services
      ↓
Monitor Authentication

Coordinate with service owners.

66. Step 58 — Escalation Criteria

Escalate when:

Unauthorized successful login confirmed

Privileged account involved

MFA compromise suspected

Malicious endpoint activity follows login

Persistence identified

Multiple accounts targeted

Lateral movement observed

Sensitive resources accessed

Account compromise remains active

67. Authentication Escalation Template

Use:

Case ID:

Alert:

Classification:

Severity:

Identity:

Account Type:

Privilege:

Source IP:

Source Context:

Destination:

Authentication Method:

Failed Attempts:

Successful Login:

MFA Status:

First Suspicious Activity:

Last Suspicious Activity:

Endpoint Activity:

Network Activity:

Related Accounts:

Related Assets:

Compromise Status:

Threat Status:

Actions Taken:

Recommended Containment:

Outstanding Questions:

Escalated To:

68. Example Confirmed Compromise

Case:
AUTH-2026-041

Classification:
Confirmed Account Compromise

Severity:
High

Identity:
user01

Source:
Unrecognized external IP

Activity:
Repeated authentication failures were followed
by successful authentication and MFA approval.

Follow-On Activity:
The account established remote access to WIN01.

Endpoint:
Suspicious PowerShell activity occurred shortly
after the session began.

Network:
WIN01 subsequently contacted suspicious
external infrastructure.

Assessment:
Evidence supports unauthorized use of user01.

Recommended Response:
Disable or secure user01, revoke sessions,
reset authentication credentials and MFA,
isolate WIN01, preserve evidence, and investigate
additional internal access.

69. Example Password Spray Investigation

Classification:
Password Spraying Attempt

Source:
External IP

Accounts Targeted:
37

Attempts Per Account:
1–2

Successful Authentication:
None identified

MFA:
No successful MFA events

Impact:
No confirmed compromise

Severity:
Medium

Status:
Attack blocked / unsuccessful

Response:
Block validated malicious source where appropriate,
monitor targeted identities, review authentication
controls, and search for related infrastructure.

70. Example Benign Authentication

Classification:
Benign True Positive

Alert:
Unusual Geographic Authentication

Identity:
user02

Investigation:
Authentication originated from the corporate VPN.

Location:
The VPN exit node caused the authentication to
appear in an unexpected geographic region.

Device:
Known corporate-managed endpoint.

MFA:
Successful.

Follow-On Activity:
Normal user behavior.

Impact:
None.

Disposition:
Close as Benign True Positive.

71. Common Analyst Mistakes

Avoid:

Treating every failed login as an attack

Ignoring successful logins after failures

Ignoring MFA events

Assuming MFA guarantees legitimacy

Relying solely on geolocation

Ignoring VPN/proxy context

Ignoring logon type

Ignoring service-account behavior

Ignoring privileged access

Looking only at authentication logs

Failing to investigate endpoint activity

Failing to revoke sessions

Resetting passwords without token consideration

Treating all contacted systems as compromised

Failing to search the source across other users

Failing to search the user across other systems

72. Rapid Authentication Triage Checklist

□ User identified

□ Account type identified

□ Privilege determined

□ Source IP identified

□ Source context reviewed

□ Destination identified

□ Failed logins counted

□ Successful logins reviewed

□ Failure-to-success sequence checked

□ Logon type reviewed

□ MFA reviewed

□ Device context reviewed

□ Geographic context reviewed

□ VPN activity reviewed

□ Endpoint activity reviewed

□ Network activity reviewed

□ Privileged activity reviewed

□ Related accounts searched

□ Related systems searched

□ Threat intelligence checked

□ Identity scope determined

□ Asset scope determined

□ Compromise status assigned

□ Severity assigned

□ Active sessions considered

□ Containment evaluated

□ Escalation decision made

□ Investigation documented

73. Investigation Documentation Template

# Suspicious Authentication Investigation

## Case Information

Case ID:

Analyst:

Date:

## Alert

Alert Name:

Detection Source:

Detection Time:

## Identity

Username:

Account Type:

Privilege:

Department:

Normal Device:

## Source

IP:

Hostname:

Device:

Network:

Location Context:

ASN / Provider:

## Destination

System:

IP:

Application:

Service:

Criticality:

## Failed Authentication

Count:

First:

Last:

Failure Reason:

## Successful Authentication

Observed:
Yes / No

Timestamp:

Source:

Destination:

Logon Type:

## MFA

Required:

Result:

Method:

Suspicious MFA Activity:

## Device Analysis

Known / Unknown:

Managed:

Expected:

## Authentication Pattern

Brute Force / Password Spray / Credential Stuffing / Anomalous Login / Other

## Privileged Activity

Document findings.

## Endpoint Activity

Document:
- processes
- PowerShell
- files
- alerts

## Network Activity

Document:
- DNS
- connections
- IDS alerts

## Lateral Movement

Observed / Suspected / Not Observed

Document evidence.

## Threat Intelligence

Document source-IP enrichment.

## Related Accounts

Document targeted or affected identities.

## Related Systems

Document systems accessed.

## Authentication Timeline

Insert chronological events.

## Identity Scope

Confirmed Compromised:

Suspected:

Targeted:

Unaffected:

Unknown:

## Asset Scope

Document affected systems.

## Impact

### Confidentiality

### Integrity

### Availability

## Compromise Assessment

Confirmed / Suspected / Not Compromised / Unknown

## Severity

Low / Medium / High / Critical

## Threat Status

Active / Contained / Historical / Unknown

## Containment

Document actions or recommendations.

## Escalation

Escalated:
Yes / No

Escalated To:

## Outstanding Questions

Document gaps.

## Final Analyst Assessment

Summarize findings.

## Disposition

Close / Monitor / Continue Investigation / Escalate

74. Runbook Validation Checklist

Identity

• User identified

• Account type established

• Privilege determined

• Account criticality assessed

• Normal activity context reviewed

Source

• Source IP identified

• Device context reviewed

• Network context reviewed

• Geographic context reviewed

• VPN/proxy context considered

• Threat intelligence reviewed

Authentication

• Failed logins investigated

• Failed attempts counted

• Brute-force pattern considered

• Password spraying considered

• Credential stuffing considered

• Successful logins investigated

• Failure-to-success sequence reviewed

• Logon type analyzed

• Failure reasons reviewed

MFA

• MFA activity reviewed

• MFA failures investigated

• MFA approvals investigated

• MFA fatigue considered

• New MFA methods reviewed where relevant

Privilege

• Privileged authentication reviewed

• Privilege escalation distinguished from privileged credential use

• Account/group changes investigated where relevant

Correlation

• Endpoint activity investigated

• Process activity reviewed

• PowerShell activity reviewed

• Network activity reviewed

• Related alerts searched

• Related users searched

• Related systems searched

Scope

• Identity scope established

• Asset scope established

• Lateral movement considered

• Compromised vs accessed systems distinguished

Impact

• Confidentiality assessed

• Integrity assessed

• Availability assessed

• Active sessions identified

• Threat status determined

Response

• Compromise status assigned

• Severity assigned

• Credential containment considered

• Session revocation considered

• MFA reset considered where relevant

• Endpoint containment considered

• Escalation criteria evaluated

Documentation

• Authentication timeline created

• Supporting evidence documented

• Outstanding questions recorded

• Final disposition documented

75. Runbook Summary

Authentication investigations should not stop at:

Failed Login

The analyst must reconstruct:

Identity
   ↓
Source
   ↓
Authentication Attempts
   ↓
Successful Access
   ↓
MFA
   ↓
Session
   ↓
Endpoint Activity
   ↓
Network Activity
   ↓
Privilege
   ↓
Lateral Movement
   ↓
Impact

The key operational lesson is:

The most important authentication event is often not the failed login that generated the alert, but what happened immediately before and after a successful authentication.

A strong identity investigation combines:

Authentication Logs
        +
Identity Context
        +
MFA
        +
Device Context
        +
Endpoint Telemetry
        +
Network Telemetry
        +
Threat Intelligence
        =
Account Compromise Assessment

What’s Next?

CySA+ Runbook 03 — Phishing Email Investigation and Response

The next runbook moves from identity alerts to one of the most common initial-access vectors encountered by SOC analysts.

You will build a repeatable procedure for investigating:

• reported phishing emails

• sender information

• email headers

• source infrastructure

• SPF, DKIM, and DMARC results

• reply-to manipulation

• suspicious URLs

• redirect chains

• attachments

• file hashes

• threat-intelligence enrichment

• email delivery scope

• user interaction

• credential submission

• endpoint execution

• related authentication activity

• mailbox searching

• message containment

• affected-user response

• enterprise IOC hunting

• escalation

The workflow progresses from:

Suspicious Email
      ↓
Header Analysis
      ↓
Sender Validation
      ↓
URL / Attachment Analysis
      ↓
Threat Intelligence
      ↓
Delivery Scope
      ↓
User Interaction
      ↓
Endpoint / Identity Correlation
      ↓
Compromise Assessment
      ↓
Containment
      ↓
Escalation

➡️ Next: CySA+ Runbook 03 — Phishing Email Investigation and Response