A successful sign-in is not the end of an identity attack. Once an attacker holds a session, the harder question is what they can create or use, and what defenders must remove before declaring the account clean. In this webcast, Maxim Deweerdt takes the “Chasing Ghosts” RSA follow-up into a practical investigation of post-sign-in access in Microsoft Entra environments.
Using clearly separated incident reporting and lab research, Maxim will examine unauthorized device enrollment and new Windows Hello for Business credentials, local use of an existing victim key on a compromised endpoint, and the boundaries of session replay protection.
An illustrative investigation walkthrough will show how to connect non-interactive sign-ins, directory changes and workload activity, then use that evidence to guide revocation, credential rotation, removal of confirmed persistence and validation of cleanup.
Who should attend?:
Designed for SOC analysts, identity administrators, detection engineers, and incident responders, this session focuses on what to investigate after the sign-in and how to test whether eviction actually worked.
Learning objectives:
- Explain why a successful sign-in is only the starting point for investigating identity compromise
- Identify common post-sign-in persistence mechanisms in Microsoft Entra environments, including unauthorized device enrollment and new Windows Hello for Business credentials
- Connect identity telemetry such as non-interactive sign-ins, directory changes, device activity, and workload activity to reconstruct attacker access
- Determine which sessions, credentials, devices, and persistence mechanisms must be revoked, rotated, removed, or validated during cleanup
- Apply investigation and eviction concepts that support the identity security practices covered in SANS SEC559: Identity Security for Cloud, Hybrid, and Agentic
This session supports concepts from the SANS SEC559: Identity Security for Cloud, Hybrid, and Agentic. To learn more about this course, browse upcoming runs, and access your free preview, CLICK HERE!
