> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compromised Account Containment

> An account needs containing NOW — run the rapid checklist (block sign-in, revoke sessions, reset password, sweep MFA and rules) and timestamp every step in the ticket note.

<Info>
  **Category:** Security · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/security/compromised-account-containment/SKILL.md)
</Info>

**Connectors:** none — works with Thread out of the box

**Role:** [Security & Compliance Owner](/start-here/roles/security-compliance-owner), [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response, Risk & Compliance

**When to use:** Any skill or tech concludes "this account is compromised or credibly might be"; a phishing victim entered credentials moments ago; or mid-incident an additional account turns out to be affected.

**Run it:** on one ticket (an account that needs containing now).

## Prompt

```
You are running the five-move containment checklist — no investigation, no report-writing:
stop the access, record the clock. The full workup lives in account-takeover-runbook; this
is the part that cannot wait for it. You direct and record; the technician executes the
console actions. Work it in order:

1. Block sign-in: disable the account or block interactive sign-in in the identity console.
   Timestamp it in the ticket note the moment it's confirmed done.
2. Revoke all active sessions and refresh tokens — blocking sign-in does not kill existing
   sessions; this step does. Timestamp.
3. Reset the password. Deliver the new credential out-of-band through a verified channel
   (voice, to a number on file) — never through the affected mailbox or any channel the
   attacker may read. Timestamp.
4. MFA sweep: review registered MFA methods and devices; remove anything the user does not
   recognize; timestamp each removal.
5. Rules-and-consent sweep: check inbox rules, forwarding, delegates, and OAuth app
   consents for attacker persistence; remove what's malicious; timestamp.
6. Post the running containment note as each step lands — not one note at the end. Format
   each line as plain text: timestamp, action, who executed it, outcome. The opening line
   records WHY containment was triggered. Then hand off to account-takeover-runbook for
   investigation, blast radius, and notification.

Guardrails — always:
- Contain fast, investigate second — this runs on credible suspicion, before evidence is
  complete. The cost of containing a false positive is one inconvenienced user; the cost
  of waiting is not.
- Timestamps are mandatory on every step — the containment timeline is what insurers,
  auditors, and the postmortem all ask for.
- Order matters: sessions must be revoked in addition to the password reset, or the
  attacker keeps riding the old tokens.
- Never communicate through the affected account, and never deliver the new credential to
  contact details sourced from the suspect session or ticket — verified, on-file channels
  only.
- Containment is not closure — the ticket stays open and moves to account-takeover-runbook.
  Never mark contained as resolved. Plain text only; never invent timestamps or evidence.
```


## Related topics

- [Delegate Access Forensics](/skill-library/m365-administration/delegate-access-forensics.md)
- [Mail Forwarding Audit](/skill-library/m365-administration/mail-forwarding-audit.md)
- [Business Email Compromise Recovery](/skill-library/security/business-email-compromise-recovery.md)