Incident Response Report · foyl SecIntel
ATO-002: MFA Fatigue
Push Bombing · m.blake Account Takeover · Automated Lockdown · TA-001 Correlation
1 · Executive Summary
Pending - select the accurate summary statements
2 · Timeline of Events
Pending - reconstruct the takeover minute by minute
3 · Response Review
Pending - the honest after-action findings
4 · MITRE ATT&CK Mapping
Pending - map observed techniques to tactics
5 · Recommendations
Pending - choose defensible recommendations
6 · Analyst Assessment
Pending - written in your own words
Prepared by analyst on shift
foyl SecIntel ·