# Investigate a suspicious sign-in on a user account

Works through risky sign-in signals like impossible travel or MFA spam to decide if an account is compromised.

- Topic: Software Development
- Framework: RTF
- Level: Standard
- Tags: Research, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/investigate-a-suspicious-sign-in-on-a-user-account

## Prompt

```text
Help me investigate a suspicious sign-in and decide if the account is compromised.

**Sign-in details:** [PASTE: time, user, IP, location, device, browser, app, MFA result, risk level]
**User's normal pattern:** [usual locations, devices, working hours, travel]
**Identity platform:** [e.g. "Entra ID", "Okta", "Google Workspace"]
**Other signals:** [MFA prompts the user did not start, password reset, new device registered, user report]

Investigate in this order:
1. Is the sign-in plausibly the user? Consider VPNs, mobile carriers, cloud proxies, and travel. Note which explanation the evidence supports.
2. Signs of attack patterns: password spray, MFA fatigue, token theft or session replay, legacy protocol use, adversary-in-the-middle phishing.
3. Post-sign-in activity to check: new inbox rules or forwarding, OAuth app consents, MFA method changes, mass downloads, sent mail, admin actions. Give the exact logs or portal locations to check.
4. Verdict with confidence: benign / suspicious / compromised.

If compromised or suspicious with access, list containment steps in order: revoke sessions and refresh tokens, reset password, review and reset MFA methods, remove malicious rules and app consents, block the IP, check other accounts from the same IP.

Rules: verify with the user through a known channel (not by replying to a suspicious message). Do not label an IP as malicious without reputation data; tell me where to check.

Return: verdict, evidence table (Signal | Finding | Points to), checks still needed, containment checklist, and a short note for the ticket.
```

## What to fill in

- usual locations, devices, working hours, travel
- e.g. "Entra ID", "Okta", "Google Workspace"

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.