Identity Containment

# Audit AD accounts created since a given date (attacker may have created new accounts)
$compromiseDate = Get-Date "2026-08-01"  # adjust to approximate compromise start

# Accounts created after the estimated compromise date
Get-ADUser -Filter * -Properties Created,LastLogonDate,MemberOf |
    Where-Object { $_.Created -gt $compromiseDate } |
    Select-Object SamAccountName, Created, LastLogonDate,
        @{N="Groups"; E={ ($_.MemberOf | Get-ADGroup | Select -Expand Name) -join ", " }} |
    Sort-Object Created |
    Format-Table -AutoSize

# Accounts with admin group membership — compare against known-good baseline
$adminGroups = @("Domain Admins","Enterprise Admins","Schema Admins",
                 "Administrators","Account Operators","Backup Operators")
foreach ($group in $adminGroups) {
    Write-Host "`n== $group ==" -ForegroundColor Cyan
    Get-ADGroupMember $group -Recursive | Select-Object SamAccountName, objectClass
}

# Recently modified accounts — attacker may have added to privileged groups
Get-ADUser -Filter * -Properties Modified,WhenChanged |
    Where-Object { $_.WhenChanged -gt $compromiseDate } |
    Select-Object SamAccountName, WhenChanged |
    Sort-Object WhenChanged -Descending |
    Format-Table

# Azure AD / Entra ID audit — requires AzureAD or Microsoft.Graph module
# Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","Directory.Read.All"

# Users created recently
$sinceDate = "2026-08-01T00:00:00Z"
Get-MgUser -Filter "createdDateTime gt $sinceDate" |
    Select-Object DisplayName, UserPrincipalName, CreatedDateTime |
    Sort-Object CreatedDateTime

# Users with Global Administrator role
$gaRole = Get-MgDirectoryRole | Where-Object { $_.DisplayName -eq "Global Administrator" }
Get-MgDirectoryRoleMember -DirectoryRoleId $gaRole.Id |
    Select-Object -ExpandProperty AdditionalProperties |
    ForEach-Object { [PSCustomObject]@{ UPN = $_["userPrincipalName"]; DisplayName = $_["displayName"] } }

# Recent risky sign-ins (requires Azure AD P2 license)
Get-MgAuditLogRiskyUser | Where-Object { $_.RiskLastUpdatedDateTime -gt $sinceDate } |
    Select-Object UserDisplayName, UserPrincipalName, RiskLevel, RiskState

# Bulk disable and reset compromised AD accounts
# Run this as Domain Admin from a clean, non-compromised workstation

$compromisedAccounts = @("jsmith","mwilliams","svc_backup","svc_deploy")

foreach ($account in $compromisedAccounts) {
    # Disable the account
    Disable-ADAccount -Identity $account

    # Reset password to a complex random value
    $newPassword = [System.Web.Security.Membership]::GeneratePassword(24, 4)
    Set-ADAccountPassword -Identity $account `
        -Reset -NewPassword (ConvertTo-SecureString $newPassword -AsPlainText -Force)

    # Force password change at next login
    Set-ADUser -Identity $account -ChangePasswordAtLogon $true

    # Record the reset in the case log
    Write-Host "$(Get-Date -Format 'HH:mm:ss')  Reset: $account"
}

# Also: revoke all active sessions by forcing logoff on DCs
# (kicks existing sessions that may still use old credentials via Kerberos)
Invoke-Command -ComputerName (Get-ADDomainController -Filter *).HostName -ScriptBlock {
    quser 2>$null | Where-Object { $_ -match "jsmith|mwilliams" } |
    ForEach-Object {
        $sessionId = ($_ -split "\s+")[3]
        logoff $sessionId /server:$env:COMPUTERNAME 2>$null
    }
}

# krbtgt reset — WILL DISRUPT AUTHENTICATION for active sessions
# Microsoft recommends using the Reset-KrbtgtKeyInteractive script from
# https://github.com/microsoft/New-KrbtgtKeys.ps1 for safer execution

# Manual reset (simpler, use only in emergency):
Set-ADAccountPassword -Identity "krbtgt" `
    -Reset -NewPassword (ConvertTo-SecureString `
        ([System.Web.Security.Membership]::GeneratePassword(32,6)) `
        -AsPlainText -Force)

Write-Host "krbtgt reset 1 complete at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC' -AsUTC)"
Write-Host "Wait at least 10 hours, then repeat this reset"

# After reset, users will need to re-authenticate to get new TGTs
# Kerberos-reliant services may need to be restarted to flush cached tickets
# Monitor for Kerberos error events: 4769 (KRB_AP_ERR_MODIFIED), 4771 (pre-auth failures)

# Revoke all refresh tokens for a user (invalidates all active sessions)
# Requires AzureAD module: Install-Module AzureAD

Connect-AzureAD

# Single user
Revoke-AzureADUserAllRefreshToken -ObjectId "jsmith@corp.com"

# All users at once (nuclear option — use carefully)
Get-AzureADUser -All $true | ForEach-Object {
    Revoke-AzureADUserAllRefreshToken -ObjectId $_.ObjectId
}

# Via Microsoft Graph (modern approach):
# POST https://graph.microsoft.com/v1.0/users/{id}/revokeSignInSessions

# After token revocation: users will be prompted to re-authenticate
# This forces new Conditional Access policy evaluation on re-auth

# Find every service using a given service account across the domain
# Must run as Domain Admin; queries all domain computers

$serviceAccount = "CORP\svc_deploy"
$computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name

Invoke-Command -ComputerName $computers -ScriptBlock {
    param($acct)
    Get-WmiObject Win32_Service |
        Where-Object { $_.StartName -like "*$acct*" } |
        Select-Object @{N="Computer";E={$env:COMPUTERNAME}},
                      Name, DisplayName, StartName, State
} -ArgumentList $serviceAccount -ErrorAction SilentlyContinue |
    Where-Object { $_ } |
    Sort-Object Computer, Name |
    Format-Table -AutoSize