Skip to content
HRM Framework 2.0 , home
Start the assessment

SQ-ATO-04Level 3 · Sequence4 steps in 24 hours

Help-desk takeover

A caller pretexts the help desk by voice, an analyst with reset rights opens an MFA reset ticket, a new device is enrolled on the target account, and the account signs in with admin privileges, all within 24 hours.

View in explorer Suggest a change

Classification

Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
Dimensions Every signal answers one of 3 questions.
Evidence level
Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
ATT&CK tactics
  • Initial Access
  • Credential Access
  • Persistence
  • Privilege Escalation
NIST CSF 2.0 (from its signals)
  • ID.RA-03
  • PR.AA-05
  • PR.AA-03
MITRE ATT&CK (from its signals)
  • T1566.004
  • T1098.005
  • T1621
  • T1078

The sequence, step by step

SQ-ATO-044 stepsPeak: Stage 4 Suspected

  1. Step 01ATT&CK tactic: Initial Access

    Voice pretext

    SE-T-04Receives callback or voice phishing

    Stage 1Exposed

  2. Step 02ATT&CK tactic: Credential Access

    MFA reset ticket

    SE-A-03Can reset passwords or MFA for others

    Stage 3Exploited

  3. Step 03ATT&CK tactic: Persistence

    New device

    IA-B-05Approves MFA after repeated prompts

    Stage 4Suspected

  4. Step 04ATT&CK tactic: Privilege Escalation

    Admin login

    IA-A-01Holds admin or privileged roles

    Stage 4Suspected

  5. Breach scenarioHB-02

    Credential abuse & account takeover

    Inside 24 hours

Help-desk takeover, 4 steps inside 24 hours: Voice pretext (SE-T-04 Receives callback or voice phishing, Initial Access, Stage 1 Exposed); then MFA reset ticket (SE-A-03 Can reset passwords or MFA for others, Credential Access, Stage 3 Exploited); then New device (IA-B-05 Approves MFA after repeated prompts, Persistence, Stage 4 Suspected); then Admin login (IA-A-01 Holds admin or privileged roles, Privilege Escalation, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.

A completed sequence is evidence that its steps happened in order inside 24 hours: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.

The definition, in detail

Definition

The call places the target at Stage 1, the reset moves the case to Stage 3, and the new device completes the sequence at Stage 4.

Example

A caller claiming to be a traveling executive got the service desk to reset MFA; a new phone was enrolled within the hour and the executive's admin role was used that afternoon.

The steps

4 steps, in order.

  1. Voice pretext

    SE-T-04 Receives callback or voice phishing

    ATT&CK tactic: Initial Access · Stage 1 Exposed

  2. MFA reset ticket

    SE-A-03 Can reset passwords or MFA for others

    ATT&CK tactic: Credential Access · Stage 3 Exploited

  3. New device

    IA-B-05 Approves MFA after repeated prompts

    ATT&CK tactic: Persistence · Stage 4 Suspected

  4. Admin login

    IA-A-01 Holds admin or privileged roles

    ATT&CK tactic: Privilege Escalation · Stage 4 Suspected

How it is measured

Steps
4
Window
24 hours
Sources
Email security, IT service management, Identity provider & MFA

How it is used

Programs watch the 4 steps in order inside 24 hours; a completed run moves the person to Stage 4 Suspected and points at Credential abuse & account takeover.

A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.

Continue exploring

Cite this term

"Help-desk takeover" (SQ-ATO-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ato-04-help-desk-takeover

Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.

Same breach scenario

3 other sequences end in Credential abuse & account takeover.

HB-02 Credential abuse & account takeover: every sequence, cohort and signal that points to it.

  • SQ-ATO-015 steps · 72 hours

    Phish to takeover

    1. Step 1: Real phish delivered (SE-T-02 Real phishing delivered to inbox)
    2. Step 2: Link clicked (SE-B-04 Clicks links in real phishing)
    3. Step 3: Unusual login (IA-B-04 Signs in from unusual contexts)
    4. Step 4: New MFA device (IA-B-05 Approves MFA after repeated prompts)
    5. Step 5: Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail)
    6. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-023 steps · 30 days

    Leak to login

    1. Step 1: Credential leaked (IA-T-01 Credentials leaked in a public breach)
    2. Step 2: Failed-login spike (IA-T-04 Targeted by malicious login attempts)
    3. Step 3: Unusual successful login (IA-B-04 Signs in from unusual contexts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-033 steps · 24 hours

    MFA fatigue

    1. Step 1: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts)
    2. Step 2: Odd-hour approval (IA-B-05 Approves MFA after repeated prompts)
    3. Step 3: New factor registered (IA-B-05 Approves MFA after repeated prompts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment