This one still bothers me in the way it oversimplifies analysis. Before you consider a Mass Password Reset, you absolutely must understand the nature and scope of the #threat you mean to address. If the attack has progressed to the point where #APT actors have #privileged access, there is a serious risk of krbtgt (Kerberos security "golden ticket") compromise. When this happens, you can change the #password for every user and service account with absolutely zero benefit. In fact, you may exacerbate the problem. It takes an expert to respond to #Identity attacks. Don't wait for a compromise to find your expert. Make that part of your plan. Good details from MS DART here: https://lnkd.in/gxK26YzV
Threats that involve the compromise of multiple privileged identities within the network may require a mass password reset as part of incident response. A mass password reset helps incident responders gain control of the identity plane, deny other avenues of access, and disrupt any persistence the attacker may have established in the environment. There are several variables and considerations for a mass password reset, and there is no one-size-fits-all solution. In this blog post, Microsoft Incident Response provides best practices in preparing for and performing a mass password reset: https://msft.it/6046YhXQ6