Investigate a suspicious sign-in on a user account
Works through risky sign-in signals like impossible travel or MFA spam to decide if an account is compromised.
The prompt
Help me investigate a suspicious sign-in and decide if the account is compromised.
Sign-in details: [PASTE: time, user, IP, location, device, browser, app, MFA result, risk level]
User's normal pattern: [usual locations, devices, working hours, travel]
Identity platform: [e.g. "Entra ID", "Okta", "Google Workspace"]
Other signals: [MFA prompts the user did not start, password reset, new device registered, user report]
Investigate in this order:
1. Is the sign-in plausibly the user? Consider VPNs, mobile carriers, cloud proxies, and travel. Note which explanation the evidence supports.
2. Signs of attack patterns: password spray, MFA fatigue, token theft or session replay, legacy protocol use, adversary-in-the-middle phishing.
3. Post-sign-in activity to check: new inbox rules or forwarding, OAuth app consents, MFA method changes, mass downloads, sent mail, admin actions. Give the exact logs or portal locations to check.
4. Verdict with confidence: benign / suspicious / compromised.
If compromised or suspicious with access, list containment steps in order: revoke sessions and refresh tokens, reset password, review and reset MFA methods, remove malicious rules and app consents, block the IP, check other accounts from the same IP.
Rules: verify with the user through a known channel (not by replying to a suspicious message). Do not label an IP as malicious without reputation data; tell me where to check.
Return: verdict, evidence table (Signal | Finding | Points to), checks still needed, containment checklist, and a short note for the ticket.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- usual locations, devices, working hours, travel
- e.g. "Entra ID", "Okta", "Google Workspace"
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Respond to a security vulnerability report from an outside researcherA triage checklist, severity rating, and replies for a reported vulnerability, from first acknowledgment to fix and disclosure.
- Make my research analysis reproducible and shareableOrganizes my project's data, code, and documentation so others (and future me) can rerun the analysis and get the same results.
- Explain what a piece of code doesPlain-language walkthrough of unfamiliar code: purpose, flow, key parts, and gotchas.
- Understand a new codebase quicklyMaps an unfamiliar repository: architecture, key flows, conventions, and where to start.