Preserving Evidence After a Suspicious Administrator Login
Containment matters, but so does preserving enough context to understand what the administrator identity did before access was reset.
Record the alert and current state first
Capture the time, affected account, source of the alert, relevant identifiers, and what responders can currently observe. Where safe and authorized, preserve security alerts, sign-in events, administrative changes, and other logs before retention limits or response actions remove context.
Look for actions, not just authentication
An administrator login is important because of what the identity can change. Review high-value actions that fall within scope: role changes, new accounts, recovery methods, mailbox rules, app consent, sharing changes, security-policy changes, API credentials, and deletion or disabling of security controls.
Coordinate containment
Response actions should balance account control, business continuity, and evidence preservation. For high-impact incidents, determine who needs to participate before making irreversible changes: internal IT, leadership, external providers, legal counsel, cyber insurance, or specialist responders.
Treat recovery as part of the incident
Changing a password is not the same as proving control has been restored. Review sessions, authentication methods, recovery paths, privileged roles, delegated access, tokens or keys in scope, and systems the identity could have changed. Continue monitoring after recovery.
Sources and further reading
- NIST SP 800-61 Rev. 3 — Incident Response Recommendations
- Canadian Centre for Cyber Security — Developing your incident response plan
This is general technical guidance. Apply it to your environment with appropriate authorization, evidence, and incident-specific context.