Compromise Recovery

Compromise recovery is the disciplined process of regaining administrative control of an environment during or after a significant breach, evicting the adversary in a single coordinated action, and re-establishing a trustworthy security posture so the attacker cannot return.

When to use

Responding to a confirmed widespread compromise - tenant-wide Entra/AD compromise, ransomware, persistent adversary with Global Admin or Domain Admin - where normal remediation is insufficient and the existing infrastructure cannot be trusted.

Do not use this skill for:

• Routine alert triage or single-host malware (use defender-xdr)
• Pre-incident architecture hardening (use security-architecture, entra-id, paw-design)
• Sentinel hunting and detection engineering (use sentinel)

Decide what stage you are at