Compromise Accounts: recognize the technique

Lesson Purpose

What you are learning

This technique is about taking control of an existing account for later use. Existing accounts may already have trusted contacts, permissions, or a normal history, so misuse can look legitimate at first. A familiar account can therefore become suspicious when its login pattern, settings, devices, or actions change unexpectedly.

Learning Objectives

Explain Compromise Accounts in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

A familiar email, cloud, developer, or social-media account can still be taken over. Changes in login behavior, settings, devices, or actions may reveal the problem. A familiar account may therefore require investigation when its login pattern, settings, devices, or actions suddenly change.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Account-takeover signs include unusual login locations/devices/times, unexpected MFA or recovery changes, new forwarding/settings, and actions inconsistent with the user's history.
Investigate authentication history, device/session information, account changes, and follow-on actions.
Reduce takeover risk with MFA, strong credential practices, session/device monitoring, and rapid revocation/reset procedures.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three signs of possible account takeover. Then give one investigation action and two controls that reduce takeover risk. No external account interaction is required. Use only the learner-facing material in this lesson and explain why each answer is relevant to a defender.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Compromise Accounts? This technique is about taking control of an existing account for later use. This technique is about creating resources that may support later operations. This technique is about getting capabilities from another source instead of creating them.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Unusual logins, new devices, MFA resets, changed recovery details, new tokens, and unexpected account actions Threat-intelligence reports, malware analysis, vulnerability reports, certificate records, and endpoint detections Threat-intelligence reports, vulnerability advisories, malware analysis, endpoint detections, and delivery or execution logs

3. Which interpretation best avoids overstating what the observed information proves? For an established account, changes in authentication, settings, or behavior can be stronger clues than the account name itself. Capability development may be hard to see directly. Combine outside intelligence with internal exposure and activity. Availability of an offensive capability does not prove compromise. Combine capability information with organizational exposure and observed activity.

4. Consider this behavior: This technique is about taking control of an existing account for later use. Existing accounts may already have trusted contacts, permissions, or a normal history, so misuse can look legitimate at first. Which ATT&CK technique best matches the behavior? Compromise Accounts Develop Capabilities Obtain Capabilities

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Review authentication history and security-setting changes, then revoke suspicious sessions or tokens Check whether the capability applies to technology the organization actually uses, then prioritize relevant protections Check whether the capability applies to organizational systems and whether there is evidence of delivery or use

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A familiar account name does not guarantee that the legitimate owner is still in control Evidence that a capability exists is not the same as evidence that it targets the organization The existence of an offensive tool or exploit does not prove that the organization is compromised

Learning Moment

For an established account, changes in authentication, settings, or behavior can be stronger clues than the account name itself.

Defender Perspective

Useful evidence includes unusual successful logins, new devices, MFA resets, recovery-detail changes, new tokens, mailbox-rule changes, unexpected messages, and unusual cloud or repository activity. Review login history, active sessions, token issuance, and settings changes. Reduce risk with strong MFA, session and token revocation, conditional access, least privilege, and alerts on security-setting changes. Risk reduction includes monitoring relevant activity and using controls that limit unnecessary exposure or access.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard