Abnormal Security Account Takeover Detection

Overview

Abnormal Security's Account Takeover Protection monitors sign-in activity and mailbox behavior to detect compromised internal accounts. By analyzing user behavior patterns, device fingerprints, sign-in locations, and mailbox rule changes, Abnormal identifies accounts that have been taken over by attackers. This skill covers ATO case management, investigation workflows, and remediation actions.

Account Takeover Indicators

ATO Case Field Reference

Core Fields

Sign-in Activity Fields

Mailbox Activity Fields

MCP Tools

Tool Usage Examples

List open ATO cases:

{
  "tool": "abnormal_ato_cases_list",
  "parameters": {
    "filter": "status eq 'Open'",
    "pageSize": 25
  }
}

Get ATO case details:

{
  "tool": "abnormal_ato_cases_get",
  "parameters": {
    "caseId": "ato-abc123"
  }
}

Get sign-in activity for a user:

{
  "tool": "abnormal_ato_activity",
  "parameters": {
    "email": "user@company.com",
    "fromDate": "2026-03-20T00:00:00Z",
    "toDate": "2026-03-27T00:00:00Z"
  }
}

ATO Investigation Workflows

Standard ATO Investigation

1. Review case details:
   • What indicators triggered the detection?
   • Which user is affected?
   • When was the compromise detected?
2. Analyze sign-in activity:
   • Check for impossible travel (locations too far apart in timeframe)
   • Identify the attacker's IP address and location
   • Check if MFA was bypassed or not enrolled
3. Review mailbox changes:
   • Check for auto-forwarding rules to external addresses
   • Check for delete rules targeting security notifications
   • Check for inbox rules hiding incoming emails
4. Assess damage:
   • How many emails were sent from the compromised account?
   • Were any internal users phished (lateral movement)?
   • Was sensitive data forwarded or downloaded?
5. Remediate:
   • Force password reset
   • Revoke active sessions and tokens
   • Remove malicious mailbox rules
   • Re-enable MFA if it was disabled
6. Post-incident:
   • Notify affected users who received emails from the compromised account
   • Check if credentials were used elsewhere
   • Update security policies if gaps found

Impossible Travel Investigation

1. Map sign-in locations - Plot the geographic locations and timestamps
2. Calculate travel feasibility - Could the user physically travel between locations?
3. Check VPN usage - Verify if the organization uses VPNs that could explain the location change
4. Identify legitimate sign-in - Contact the user to confirm which sign-in was theirs
5. Block attacker access - Revoke the session from the illegitimate location

Mailbox Rule Investigation

1. List all mailbox rules - Get current rules for the affected account
2. Identify suspicious rules:
   • Forwarding to external addresses
   • Deleting emails from security team or IT
   • Moving emails to hidden folders
3. Remove malicious rules - Delete any rules created during the compromise window
4. Check forwarded data - Determine what emails were forwarded to the attacker

Remediation Actions

Severity Assessment

Error Handling

Common API Errors

Best Practices

1. Respond to ATO cases immediately - Account takeovers are time-sensitive
2. Always revoke sessions first - Stop active attacker access before investigating
3. Check mailbox rules early - Forwarding rules can silently exfiltrate data
4. Verify with the user - Confirm which sign-ins were legitimate
5. Check for lateral movement - Compromised accounts often target internal users
6. Enforce MFA - Accounts without MFA are prime takeover targets
7. Monitor post-remediation - Attackers may attempt to re-compromise the account
8. Correlate with vendor risk - Account takeover may originate from a compromised vendo