KQL Search

Query Details

Hunt for accounts with leaked credentials

Hunt Accounts With Leaked Credentials

Query

IdentityInfo
| summarize arg_max(TimeGenerated, AccountUpn, AccountDisplayName, AccountDomain, CriticalityLevel, DistinguishedName) by AccountObjectId
| join kind=inner (
    ExposureGraphNodes
    // Get accounts with Leaked Credentials
    | where NodeProperties.rawData.hasAdLeakedCredentials == "true" or NodeProperties.rawData.hasLeakedCredentials == "true"
    // Get the AAD Object ID
    | mv-expand EntityIds
    | where EntityIds.type == "AadObjectId"
    | extend AccountObjectId = extract('objectid=(.*)', 1, tostring(EntityIds.id))
    | extend HasAdLeakedCredentials = tostring(NodeProperties.rawData.hasAdLeakedCredentials),
        HasLeakedCredentials = tostring(NodeProperties.rawData.hasLeakedCredentials)
    | distinct NodeLabel, AccountObjectId, HasAdLeakedCredentials, HasLeakedCredentials
) on AccountObjectId

About this query

Hunt for accounts with leaked credentials

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
TA0006Credential Accesshttps://attack.mitre.org/tactics/TA0006/

Description

This query searches for accounts where Exposure Management detected leaked credentials. This query is correlated with the IdentityInfo table, mainly because you can easily create a detection of this rule if you would like to.

Risk

This hunting query helps you in finding accounts that have leaked credentials. This mitigates the risk of easy account compromise when an attacker is using known password lists.

Author <Optional>

References

Defender XDR

Explanation

This query is designed to identify user accounts that have been compromised due to leaked credentials. It works by correlating data from two sources: the IdentityInfo table and the ExposureGraphNodes table.

Here's a simple breakdown of what the query does:

  1. Identity Information Collection:

    • The query starts by summarizing the latest information about user accounts from the IdentityInfo table. It gathers details like the account's unique identifier (AccountObjectId), email (AccountUpn), display name, domain, criticality level, and distinguished name.

  2. Leaked Credentials Detection:

    • It then looks into the ExposureGraphNodes table to find accounts marked with leaked credentials. This is done by checking specific properties (hasAdLeakedCredentials or hasLeakedCredentials) that indicate whether an account's credentials have been exposed.

  3. Data Correlation:

    • The query matches the accounts from the IdentityInfo table with those identified as having leaked credentials in the ExposureGraphNodes table using the account's unique identifier (AccountObjectId).

  4. Result Compilation:

    • Finally, it compiles a list of accounts that have been detected with leaked credentials, along with relevant details about each account.

The purpose of this query is to help security teams quickly identify and mitigate risks associated with compromised accounts, reducing the likelihood of unauthorized access by attackers using known password lists.

Details

Robbe Van den Daele profile picture

Robbe Van den Daele

Released: January 29, 2026

Tables

IdentityInfoExposureGraphNodes

Keywords

IdentityInfoExposureGraphNodesAccountUpnAccountDisplayNameAccountDomainCriticalityLevelDistinguishedNameAccountObjectIdNodePropertiesEntityIdsNodeLabel

Operators

summarizearg_maxjoinkindwhereormv-expandextendextracttostringdistincton

Actions

GitHub