Title Put compromised accounts on monitoring
ID RA2003
Description Put (potentially) compromised accounts on monitoring
Author @atc_project
Creation Date 2019/01/31
Category General
Stage RS0002: Identification


Start monitoring for authentification attempts and all potentially harmful actions from (potentially) compromised accounts.
Look for anomalies, unusual network connections, unusual geolocation/time of work, actions that were never executed before.
Keep in touch with the real users and, in case of need, ask them if they executing some suspicious actions by themselves or not.