First 15 Minutes


Purpose


Use this procedure when a user reports:

  • Fake Microsoft/IT/vendor support

  • AnyDesk, TeamViewer, HopToDesk, Quick Assist, etc.

  • Someone remotely controlling their computer

  • Credentials entered during a suspicious interaction

  • Unexpected MFA approval

  • Suspicious software installed by another person


Your job is simple:

Identify → Contain → Protect Identity → Preserve Evidence → Escalate

STEP 1 — Contact the User


Ask:

  •  What is your computer name?

  •  When did this happen?

  •  How did they contact you?

  •  What remote-support tool was used?

  •  Did they control your computer?

  •  Did you enter or tell them your password?

  •  Did you approve an MFA request?

  •  Did they install anything?

  •  Did they open any files, email or company systems?


Document the user's answers in the FreshService ticket.

STEP 2 — Is the Attacker Still Connected?


YES


Quickly record:

  • Remote-access program

  • Session/connection ID if visible

  • Current activity

  • Time

Then:


If CrowdStrike containment is unavailable:

  •  Disconnect Ethernet

  •  Disable Wi-Fi


Do NOT

  • Power off the computer

  • Uninstall the remote tool

  • Delete files

  • Clear browser history

  • Run cleanup software

STEP 3 — Did They Get Remote Control?


YES

  •  Contain the workstation

  •  Notify Cybersecurity

  •  Keep the workstation powered on


Treat the device as potentially compromised.


NO


Continue gathering information and determine whether credentials/MFA were exposed.

STEP 4 — Were Credentials Entered or Shared?


YES


From a known-clean admin device:

  •  Reset the user's password

  •  Revoke Entra/Microsoft 365 sessions

  •  Review recent sign-ins

  •  Notify Cybersecurity


If active account misuse is occurring, consider temporarily blocking sign-in.

STEP 5 — Was Unexpected MFA Approved?


YES

  •  Revoke user sessions

  •  Review MFA/authentication methods

  •  Check for unknown methods

  •  Notify Cybersecurity


Cybersecurity/IT Ops will determine whether MFA re-registration is required.

STEP 6 — Was Software Installed or Were Commands Run?


Examples:

  • PowerShell

  • Command Prompt

  • Scripts

  • Unknown EXE/MSI

  • Additional remote-support applications


YES

  •  Keep endpoint contained

  •  Do not uninstall/delete anything

  •  Notify Cybersecurity

STEP 7 — Preserve Evidence


Record or preserve:

  •  Screenshots

  •  Attacker phone number

  •  Email address

  •  Teams messages

  •  Website/URL

  •  Remote-access tool

  •  Session ID

  •  Downloaded installer

  •  Approximate incident start/end time


Do not alter suspicious files unless instructed.

STEP 8 — Escalate to Cybersecurity


Immediately escalate when:

  •  Remote control occurred

  •  Credentials were exposed

  •  Unexpected MFA was approved

  •  Software was installed

  •  Commands/scripts were executed

  •  Admin access was granted

  •  Suspicious sign-ins were identified

  •  Company files/data may have been accessed

What IT Ops Does Next


Once Cybersecurity is engaged:


IT Ops

  • Keep endpoint contained

  • Assist with identity remediation

  • Gather user/device information

  • Update FreshService

  • Assist with recovery/reimage


Cybersecurity

  • Investigates CrowdStrike

  • Reviews Entra/M365 activity

  • Checks persistence

  • Determines data exposure

  • Determines whether device can be cleaned or must be reimaged

  • Approves recovery

DO NOT RELEASE THE COMPUTER


Do not remove CrowdStrike containment until Cybersecurity confirms:

  • Investigation is complete

  • Identity is secured

  • No persistence remains

  • Device is clean or has been rebuilt

30-Second Decision Guide


If this happened... Do this
Scam call only Document
Remote tool downloaded Investigate
Remote control granted Contain + Cybersecurity
Password provided Reset + revoke sessions
MFA approved Revoke + investigate
Unknown software installed Contain + Cybersecurity
Commands/scripts executed Contain + Cybersecurity
Admin access granted High-risk escalation
Data may have been accessed Cybersecurity assessment

Remember


Remote control? Contain the PC.

Password/MFA exposed? Secure the account.

Unknown software or commands? Call Cybersecurity.

Do not delete evidence.

Do not release the workstation without Cybersecurity approval.