PPS CLASS · PROJECT 5 OF 10 · Easy-Medium

Account Takeover Investigation

Chase an impossible-travel login or MFA bypass back through the identity logs to confirm compromise.

Tools For This Project

IAM / Entra ID logsGeo-velocityMFA logs

Prerequisites

Coming soon. What you need in place before starting this project (lab state, accounts, prior projects completed) goes here.

Step-by-Step Walkthrough

Coming soon. The full walkthrough, with written steps and screenshots, is being built and filmed as part of the PPS Class. Follow along on AliTere's socials to catch it as it drops.

Notes & Tips

Coming soon. Things to pay attention to while working through this project.

Troubleshooting

Coming soon. Real problems hit while building this project, and how they got fixed.
← Escalation & Incident Documentation Log & SIEM Correlation →