Introducing Automated Account Takeover (ATO) Remediation Functionality

October 15, 2021

Detecting and remediating account takeovers is a top concern for organizations, as compromised accounts can lead to damaged brand reputation, regulatory obligations, lost user productivity, and legal repercussions. And while compromised accounts can happen in a variety of ways, credential phishing remains the most popular. New data from the Abnormal Q3 2021 Email Threat Report shows how prevalent credential phishing is, as it continues to make up a growing share of advanced attacks—from 66% of advanced attacks in Q4 2020 to over 73% of attacks in Q2 2021.

Perhaps most indicative of the way threat actors are turning their attention to compromising accounts, our data also showed a 671% increase in the weekly average of brute force attacks. These attacks occur when cybercriminals target an account and programmatically test character combinations to determine the account password. With poor password hygiene and a lack of multi-factor authentication, these attacks can quickly lead to compromise.

Introducing Automated Account Takeover Attack Remediation

With this increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. As such, we are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.

Now, when Abnormal detects a potentially compromised account, Microsoft Office 365 customers have the choice to either manually or automatically use Microsoft Active Directory APIs to remediate account takeovers.

Too fast travel notice

This functionality allows them to sign affected users out of active sessions, disable their accounts, and optionally force password resets. The security team can then work with the affected user to reset their password and re-enable their account. An example of this functionality is shown here.

Compromise notice

Once the automatic remediation setting is enabled, Abnormal will perform these actions immediately upon detection, no matter the time of day or night, to prevent further threat actor access to the account.

Eliminate Risk Due to Dwell Time

The longer a bad actor has access to an account, the wider the opportunity window is to perform malicious activities, including data exfiltration, siphoning off funds, sending lateral phishing emails, and even planting secondary malware or advanced persistent threats (APTs).

Lateral, east-west traffic often goes undetected by traditional defenses that miss out on the device and sign-in location data signals. In contrast, with an API architecture approach, Abnormal detects east-west traffic to catch internal account compromises. According to the research available in the Q1 2021 Email Threat Report, employees are four times more likely to engage attackers through lateral phishing attacks from compromised internal accounts than credential phishing attacks from external accounts.

Ato analysis overview

Abnormal account takeover remediation further reduces the meantime to respond (MTTR) by enabling administrators to perform investigations and remediation actions from within a single tool. This prevents the need to jump into yet another console such as Microsoft Azure.

Key Benefits of Automated Account Takeover (ATO) Remediation

Your time as a security analyst is valuable. With Abnormal Account Takeover Remediation, you can save time and increase visibility—making it easier than ever to ensure that your organization is protected. Other key benefits include:

  • Rapidly respond to account compromises through auto-remediation by logging out of active sessions, blocking access, resetting passwords, and helping affected users to regain access.

  • Detect compromised accounts instantly across internal employees and external partners.

  • Review explainable attack analysis to understand why an account was determined to be compromised.

Curious to see how Abnormal Account Takeover Remediation could work for you? Request a demo today.

Related Posts

B 12 03 22 SIEM
Learn about Abnormal’s enhanced SIEM export schema, which provides centralized visibility into email threats
Read More
Blog phishing cover
The phishing email is one of the oldest and most successful types of cyberattacks. Attackers have long used phishing as a common attack vector to steal sensitive information or credentials from their victims. While most phishing emails are relatively simple to spot, the number of successful attacks has grown in recent years.
Read More
Blog brand cover
For those of you who have visited the Abnormal website over the last month, you’ve seen something different—a redesigned brand focused on precision. It’s new and innovative, and different from any other cybersecurity company, because it was created with one thing in mind: our customers.
Read More
B 11 22 21 AAA
At Abnormal, our customers have always been our biggest priority. Customer obsession is one of our five company values, and we live this every single day as we provide the best email security protection available for the hundreds of companies who entrust us to protect their mailboxes.
Read More
Blog microsoft abnormal cover
Before we jump into modern threats, I think it’s important to set the stage ​​since email has been around. Since email existed, threat actors targeted email users with malicious messages, general spam, and different ways to take advantage of the platform. Then of course, more dangerous attacks started to come up… things like malware and other viruses.
Read More
Blog black friday scam cover
While cybersecurity awareness is a year-round venture, it is especially important to be mindful during certain times of the year. With Thanksgiving here in the United States on Thursday, our thoughts will likely be on our family and friends and everything we have to be thankful for this holiday season.
Read More
Blog automation workflows cover
Our newest platform capabilities help customers streamline critical security workflows, like triaging phishing mailbox submissions or triggering tickets to investigate account takeovers, through automated playbooks. Doing so can decrease mean time to respond (MTTR) to incidents, further reducing any potential risk to the organization and eliminating manual workflows to save time and increase the efficiency of IT and security teams.
Read More
Blog tsa scam cover
On November 9, 2021, we identified an unusual phishing email that claimed to be from “Immigration Visa and Travel,” inviting the recipient to renew their membership in the TSA PreCheck program. The email wasn’t sent from a .gov domain, but the average consumer might not immediately reject it as a scam, particularly because it had the term “immigrationvisaforms” in the domain. The email instructed the user to renew their membership at another quasi-legitimate-looking website.
Read More
Blog pyspark cover
At Abnormal Security, we use a data science-based approach to keep our customers safe from the most advanced email attacks. This requires processing huge amounts of data to train machine learning models, build datasets, and otherwise model the typical behavior of the organizations we’re protecting.
Read More
Blog tiktok attack cover
As major social media platforms have expanded the ability of creators to monetize their content in the last few years, they and their users have increasingly found themselves the targets of malicious activity. TikTok is now no exception.
Read More
Blog ransomware guide cover
While various state agencies and the private sector keep track of ransomware attacks and related tactics worldwide, malicious actors change and evolve their ransomware strategies all the time. We’ve put together a comprehensive guide that will define ransomware, how to detect it, and what steps to take if you’ve fallen victim to a ransomware virus attack.
Read More
Blog detection efficacy cover
One of the key objectives of the Abnormal platform is to provide the highest precision detection to block all never-before-seen attacks. This ranges from socially-engineered attacks to account takeovers to everyday spam, and the platform does it without customers needing to create countless rules like with traditional secure email gateways.
Read More