Account takeover
Account takeover is unauthorized control of an existing account that lets an attacker act as its user within the access available to that account or session.
What makes it a takeover
An attacker can use an existing account without installing malware. MITRE documents this abuse of valid accounts in local, domain, and cloud environments. What the attacker can reach depends on the account’s permissions and the service’s controls. One compromised mailbox does not mean the whole organization is compromised.
A stolen password or suspicious sign-in is a reason to investigate. To call it a takeover, you need evidence that an unauthorized person gained control of the account.
Work out what the attacker actually did
Scope the investigation around the account’s actual access. Mail sent by an intruder, changes to recovery methods, and file downloads each tell you something different about how the account was used. Keep confirmed activity separate from access the attacker could have used.
For Microsoft 365, Microsoft’s response guidance covers sign-ins, account changes, application consent, and forwarding rules. The user’s permissions and connected services help determine where else to look.
Containment may require a password change, removal of unauthorized authentication methods or application grants, and session revocation. Check the affected services after those changes; applications can maintain sessions separately from the identity provider.