The instinct on discovering a possible compromise is to fix it. Change the passwords, wipe the device, reinstall from clean. Every one of those instincts destroys evidence. The right order is preserve, then investigate, then remediate.
Preserve, before anything else
- Take affected devices offline, but do not power them down if they can be safely isolated.
- Do not log in from the same device to reset passwords.
- Note the time, the symptoms and any error messages, in writing.
- Ask the client to stop using the account and any linked accounts.
Investigate on copies
A forensic image of the device and, where relevant, exports of the account audit logs are the foundation of any real answer. Working on the live device destroys the evidence that would identify how the intruder got in and what they took.
Then remediate
Only when the evidence is preserved do you rotate credentials, revoke sessions and rebuild. In that order, the investigation and the remediation reinforce each other. In the other order, you have neither.