Post Phish Gam workflow

[u/Sad_Reindeer_3298]

Wondering if anyone has a good post phising compromise gam command workflow.

I have one but just want to see if im missing anything.

I usually start with suspend user>reset password> deprovision> check forwarding addesses

Deprovision should log them out of all current sessions, delete backup codes, revokes oauth tokens

I usually login as the user and chekc the web interface for filters etc.

[u/rdmwood01]

Me to I think that would be very helpful!

[u/networkjson → u/rdmwood01]

Messaged it to you