Research
Credential Rotation Under Active Intrusion

Credential Rotation Under Active Intrusion

XENOPS Research XENOPS Research • Oct 02, 2025

A staged rotation plan that avoids service collapse while removing attacker persistence.

Objectives

Rotation must be fast enough to cut attacker access, but measured enough to keep critical services running.

Stage plan

Stage 1: Containment

Freeze privileged account creation and snapshot authentication logs.

Stage 2: Rotation

Rotate high-risk identities first (domain admins, CI/CD service accounts, cloud root keys).

Stage 3: Validation

Confirm that every rotated identity can still service required workloads.

rotation_order:
  - domain_admins
  - ci_cd_service_accounts
  - cloud_root_keys
  - backup_operators

Use temporary access exceptions that expire automatically. Manual exceptions are where persistence returns.

Table of contents