High severityNIST SP 800-6141 steps · 6 phases

Phishing and Initial Access: Email, Malicious Attachment, AiTM and MFA Bypass

Incident response playbook for phishing email, malicious attachment/link execution, and AiTM/MFA bypass incidents.

Updated: June 13, 2026

Information note

Informational note: When responding to an AiTM-based MFA bypass (MITRE T1557, T1566), in addition to revoking session cookies, review all Conditional Access policies and examine the actions performed by the attacker using the stolen session cookie across the full time span in audit logs. Until phishing-resistant MFA (FIDO2/CBA) deployment is complete, enforce an additional verification step for sign-in attempts from unusual locations/IPs as a temporary measure.

Prepare

6 steps

Reporting channel
A user channel for phishing reporting must be ready (phish button or security email address); mark as missing control if absent.
Email gateway
URL rewrite (Safe Links) and attachment sandbox detonation must be active; QR code analysis must be enabled.
Detection rules
Entra ID SigninLogs → SIEM integration must be operational; AiTM indicator (`anomalousToken`) and MFA fatigue (`push bombing`) rules must be in production.
Authority definition
SOC authority to suspend accounts, execute `Revoke-MgUserSignInSession`, and run Exchange Online Compliance Search must be pre-defined and tested.
Classification criteria
The P1–P4 threshold for the incident and the 72-hour window for GDPR notification must be documented.
MFA status
Phishing-resistant MFA (FIDO2/passkey) or at minimum number matching must be enabled organization-wide; push-only MFA is insufficient against AiTM.

Phishing and Initial Access: Email, Malicious Attachment, AiTM and MFA Bypass

Prepare

Detect & Analyze

Contain

Eradicate

Recover

Post-Incident