68 lines
3.0 KiB
Markdown
68 lines
3.0 KiB
Markdown
# Account Health Check — barbara@bardach.net
|
|
|
|
- **Date (UTC):** 2026-07-03 00:25
|
|
- **Trigger:** MS Authenticator "behaving crazy," trouble logging in to services
|
|
- **Tenant:** bardach.net (`dd4a82e8-85a3-44ac-8800-07945ab4d95f`)
|
|
- **Tooling:** remediation-tool 10-point user breach check (investigator + investigator-exo tiers, read-only)
|
|
|
|
## Verdict
|
|
|
|
**No compromise indicators found.** Account hygiene is clean. The Authenticator trouble
|
|
correlates with an MFA re-registration + Windows Hello enrollment performed TODAY at
|
|
~2:20 PM local on her own office PC — verify that activity was legitimate (her or a tech).
|
|
|
|
## Findings
|
|
|
|
| Check | Result |
|
|
|---|---|
|
|
| Account enabled | true; created 2020-05-24 |
|
|
| Password last changed | 2026-01-18 |
|
|
| Mail forwarding (internal/SMTP) | none |
|
|
| Inbox rules | 1 visible: "Move Graymail to folder" (INKY graymail, **disabled**) — benign |
|
|
| Hidden inbox rules | none |
|
|
| Mailbox delegates (non-SELF) | none |
|
|
| Send-As grants | none |
|
|
| OAuth consents | 1: zipForm Plus (Mail.Send, principal consent) — legitimate realtor software |
|
|
| App role assignments | 6 (standard) |
|
|
| Risk detections | 0 (risky-user API forbidden — no Identity Protection license) |
|
|
| Sign-in logs | **unavailable — tenant has no Entra ID P1** (Graph returns NonPremiumTenant) |
|
|
| Directory audits (30d) | 3 entries, all today — see timeline |
|
|
|
|
## Auth methods (6) — all consistent with Barbara
|
|
|
|
| Method | Detail |
|
|
|---|---|
|
|
| Password | rotated 2026-01-18 |
|
|
| SMS phone | +1 520-275-3867 (mobile) |
|
|
| Microsoft Authenticator | iPhone (iOS) |
|
|
| Windows Hello | BCB-OFFICE26 — **created 2026-07-02 21:24 UTC (2:24 PM local, TODAY)** |
|
|
| Windows Hello | LAPTOP-E5EKEJT8 — 2025-11-08 |
|
|
| Windows Hello | (blank name) — 2023-09-23, stale leftover from an old PC; candidate for cleanup |
|
|
|
|
Registered devices all known/hers: Surface-Pro (2020), BCB-Office (2023), BCB-OFFICE2023,
|
|
iPhone 15 Pro Max, LAPTOP-E5EKEJT8, BCB-OFFICE26 (registered 2026-02-13).
|
|
|
|
## Today's timeline (UTC)
|
|
|
|
| Time | Event | Actor |
|
|
|---|---|---|
|
|
| 21:19:49 | Update user (MFA method change) | Azure MFA StrongAuthenticationService |
|
|
| 21:24:17 | Update user (device registration) | Device Registration Service |
|
|
| 21:24:17 | Add Windows Hello for Business credential (BCB-OFFICE26) | barbara@bardach.net |
|
|
|
|
## Recommendations
|
|
|
|
1. **Confirm the 2:19-2:24 PM changes were legitimate** (Barbara or a tech at BCB-OFFICE26).
|
|
If nobody did this deliberately: rotate password + revoke sessions immediately.
|
|
2. If unprompted Authenticator pushes continue: remove + re-add the account in the
|
|
Authenticator app on her iPhone (fixes broken registrations), confirm phone date/time
|
|
is set automatically.
|
|
3. Optional hygiene: delete the blank 2023 Windows Hello method.
|
|
4. Visibility caveat: without Entra P1 there are no sign-in logs, so MFA-fatigue attempts
|
|
cannot be ruled out from logs alone. Cheap insurance if in doubt: password rotation +
|
|
session revocation.
|
|
|
|
## Raw artifacts
|
|
|
|
`/tmp/remediation-tool/dd4a82e8-85a3-44ac-8800-07945ab4d95f/user-breach/barbara_bardach_net/`
|