Handling a breach where attackers have administrative access

Administrative access turns a routine incident into a control-plane crisis. An intruder holding domain administrator rights can create trusted accounts, weaken policies, intercept recovery traffic and quietly retain access while visible symptoms are cleaned away. The priority is to establish trustworthy control before restoring normal operations.

Knowing how to handle a breach where attackers have administrative access means treating every credential, backup and audit trail as potentially compromised. Under the Privacy Act 1988, covered Australian organisations must assess whether unauthorised access has caused a notifiable data breach, with notification to affected people and the Office of the Australian Information Commissioner when the serious-harm threshold is met. Not every cyber incident triggers notification, but every incident warrants that assessment.

CARM, developed by Exclusive Networks, addresses this post-breach challenge by integrating security technologies from multiple vendors. Its ecosystem supports coordinated identification, containment, response and remediation, giving enterprises a practical way to manage several compromised technologies without relying on disconnected tools. The result is a shared operating picture for security teams coordinating technology, legal obligations and business continuity.

A sound operating assumption is that the attacker’s privileged session remains valid until identity, infrastructure and recovery channels have been independently verified. This approach protects against “administrator has been removed” claims that merely relocate the attacker’s persistence. It also creates the evidence needed for insurers, regulators, law enforcement and affected customers.

Secure the control plane first

Treat the identity provider and administrative network as the first containment zone. From a known-clean system, suspend the attacker’s sessions and privileged accounts, revoke refresh tokens and OAuth grants, remove unauthorised service principals or federated applications, and block confirmed command-and-control infrastructure. Blocking a single endpoint while leaving administrative APIs open allows the intruder to recreate the foothold.

Protect the response team from the same control plane it is trying to regain. Use an out-of-band communications channel, a clean incident-response workstation and newly issued emergency administrator accounts protected by phishing-resistant multifactor authentication. Keep forensic and security personnel able to enter without sharing compromised administrator credentials. Where operations continue, document every emergency change, including who approved it and how it will be reversed.

Preserve evidence while containment proceeds. Collect relevant identity-provider sign-ins, privileged audit logs, endpoint telemetry, firewall records, cloud control-plane events and mailbox changes; retain the original records with timestamps and hashes where practical. ASD’s Australian Cyber Security Centre publishes joint guidance on isolating compromised accounts and strengthening identity controls. A suspected breach can also be reported to ACSC, while legal and sector contacts determine notification duties.

Hunt for persistence and hidden access

Expand the hunt beyond the account initially used for entry. Administrative access permits changes that ordinary endpoint tooling may miss: newly delegated administrators, modified groups, shadow copies, scheduled tasks, malicious PowerShell profiles, registry run keys, stolen SSH keys, web shells, altered services and unauthorised certificate or trust changes. Compare the current environment with known-good configurations and recent change records, then convert each unexplained difference into a specific investigation item.

Domain controllers deserve particular scrutiny. Check SYSVOL, Group Policy objects, replication settings, privileged group membership, Directory Services Restore Mode credentials and audit logging for signs of tampering. If those controls cannot be trusted, rebuild the affected components from known-good media instead of restoring them blindly. Apply the same standard to hypervisors, network appliances, security tools and backup systems, because a privileged intruder can poison the recovery path.

Australian enterprises commonly combine in-house operations with managed-service partners in Sydney and Melbourne, so provider portals, jump hosts and remote-management accounts belong in the investigation. Review supplier contracts, named administrators and retained logs, including any customer access enabled during the incident. A clean bill of health from a provider needs configuration evidence, not merely a reassuring email.

For an organisation using .au or .com.au domains, verify registrations, nameservers, delegation, renewal details and transfer locks with the authorised registrar, using auDA’s published processes as the authoritative reference. Review domain administrator roles and registrar access separately from internal Active Directory rights. Check that no new authorisation code, contact address or billing account was added, and remove anything that cannot be explained.

Rebuild trust in identity and infrastructure

Recovery starts with a trusted path back into the environment. Establish a separate administration segment or tenant, create fresh privileged identities from clean workstations, and rotate every secret the attacker could have read. That includes service-account passwords, API keys, deployment credentials, certificate private keys, virtualisation tokens, remote-access credentials and backup-vault secrets. Resetting only the account named in the alert leaves shared credentials and standing access untouched.

Rebuild systems to a known-good state wherever administrative tampering is possible. Golden images, configuration sources and firmware or management-plane integrity must be independently validated. Re-enrol affected endpoints, reissue trusted certificates, remove unauthorised browser and OAuth consents, and verify mobile-device registrations. The Australian Signals Directorate’s Essential Eight provides a useful baseline for controlling privileged accounts, patching applications, logging and backups, although it is not itself a mandatory legal standard.

Return business workloads gradually through isolated test paths. Confirm authentication, authorisation, file access, email routing, monitoring and rollback behaviour before reconnecting critical systems. CARM can help coordinate these remediation activities across multiple security technologies while giving responders a consolidated view of containment and outstanding actions. Treat a vendor-generated “clean” status as evidence to validate, not proof that persistence has ended.

Recover communications and business services

Examine business email as both a data source and an attack route. Remove unexpected inbox rules, forwarding addresses, delegates, shared-mailbox access, transport rules and mailbox OAuth permissions. Review sent, deleted and recovered items for impersonation activity, and ensure support teams know which messages are genuine before they answer customers. Use a clean channel to contact partners whose payment or account details may have changed.

Once clean infrastructure is sending again, restore authentication and monitor the domain’s delivery reputation carefully. SPF, DKIM and DMARC should reflect the services actually used, avoiding excessive DNS lookups or unnecessary records. The practical steps to recover sender reputation explain how authentication alignment and delivery signals affect trust after spoofing. Apply changes in stages, watch authentication results, and correct the underlying mail flow before tightening enforcement.

Recovery extends beyond email to collaboration tools, identity providers, customer portals, developer systems and remote-support platforms. Reissue affected application secrets, inspect service accounts with broad permissions, and validate data exports or transfers made while the intruder held control. Keep affected users informed through verified channels, and maintain the Privacy Act assessment alongside service restoration so notification decisions do not wait for every forensic question to be answered.

Coordinate validation and institutional learning

Completion requires validation from several directions. Test privileged workflows, ordinary-user access, backups, failover, logging and alert delivery; hunt again for the persistence patterns found earlier; and watch for renewed authentication anomalies. Establish measurable exit criteria, including a clean privileged-access review, verified logging coverage and named ownership of residual risk. In practical terms, “the systems are back” is not the same as “the systems are trustworthy.”

CARM’s multi-vendor ecosystem is suited to this evidence-led approach because it can help unify technical findings, containment decisions and remediation tracking after an intrusion. Use that view to coordinate internal teams and managed-service partners, while keeping case notes, approvals, timestamps and validation results in one incident record. For Australian organisations with obligations across state and federal regimes, include privacy, sector-regulator and contractual notifications in the same decision log.

Test the process before another attacker chooses the timing. Run a scenario in which a domain administrator creates a hidden account, suppresses logs and modifies backup configuration. Measure who can revoke that access, who communicates the decision and who proves recovery. Australian operations spanning Perth, Brisbane, Sydney and Melbourne benefit from time-zone-aware handovers, but a handover still needs a live record of affected systems, blocked identities, pending approvals and next actions.

The immediate next step is a 30-minute control-plane verification session with the incident commander, identity administrator, infrastructure lead and legal adviser. Its output is a short register of trusted administrative paths, isolated assets, exposed credentials and recovery actions, each with one owner and a deadline.