1-minute read
What a defender needs to know
A caller posing as help desk staff persuaded an employee to share an SMS self-service password-reset code. Sophos X-Ops traced the resulting Microsoft Entra account takeover through a new Windows device and a PRT-backed session. The intruder downloaded approximately 100,000 SharePoint files and exported a ServiceNow sys_user CSV containing approximately 2,500 records. The same account accessed Salesforce; its automated response froze the account. The intruder also deleted an email warning users about the scam calls.
For an affected identity, line up the SSPR completion, device registration and Entra sign-ins with GraphApiAuditEvents, MailItemsAccessed, SearchQueryInitiatedSharePoint, SharePoint downloads and federated SaaS sign-ins. Check ServiceNow sys_user exports and attachment reads, including the record count. Tighten SMS-based recovery and require MFA or authentication strength through Conditional Access on Register or join devices; for a compromised user, revoke Entra sessions and refresh tokens and end sessions in the connected SaaS apps. Confirm the suspect device is removed, then test an authorized enrollment and a new sign-in against the intended policy. Passive reading of existing Teams messages has no read audit trail, so use the surrounding identity and application events when scoping access.