The access review that approved itself Start this lab

Why this matters

An access review is the control most organizations claim and fewest can evidence. The bundle is the control: if the decision file contains a self-approval, or its digest no longer matches, the review did not happen no matter who signed the summary.

Concepts

Objectives graded

• Read the decision file rather than the review summary
• Find the self-approval and count stale accounts against the stated rule
• Check the evidence bundle's digests before you rely on it
• Record the failure against the control it belongs to

MITRE ATT&CK coverage

Standing privilege that reviews itself, and dormant accounts nobody revoked: the access path an intruder prefers because nothing about it looks like an attack.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The findings came from the evidence bundle on the host rather than from the review summary.

  investigation · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The self-approval was found by comparing owner against reviewer, row by row.

  investigation · weight 10 · T1098 Account Manipulation (Persistence)

• Staleness was counted against the bundle's stated rule and date, not eyeballed.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The evidence chain was checked, so the bundle is treated as evidence rather than as a claim.

  explanation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The finding was tied to the control it actually fails, so it lands in the right register.

  configuration · weight 10 · T1098 Account Manipulation (Persistence)

• The self-approved privileged path was suspended under approval while the review is redone.

  safety · weight 20 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Accepting the review summary's headline outcome without opening the decision file.
• Eyeballing stale accounts instead of counting against the stated rule and date.
• Ignoring the digest log because the contents look plausible.
• Raising the finding against no control, so it never reaches a register.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.