huntrule

Azure AD Risk Detection: Leaked Credentials Event (leakedCredentials)

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

FreeUnreviewedSigmahighv1
title: "Azure AD Risk Detection: Leaked Credentials Event (leakedCredentials)"
id: 69cf4587-c9f7-47da-972b-18b70baf4ad3
status: test
description: This rule flags Azure AD risk events where a user’s valid credentials are marked as leaked. Leaked credentials enable attackers to attempt reuse for sign-in and subsequent account access, making timely alerting important. It relies on Azure risk detection telemetry, specifically events with riskEventType set to leakedCredentials.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#leaked-credentials
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1589
  - attack.reconnaissance
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: leakedCredentials
  condition: selection
falsepositives:
  - A rare hash collision.
level: high
license: DRL-1.1
related:
  - id: 19128e5e-4743-48dc-bd97-52e5775af817
    type: derived

What it detects

This rule flags Azure AD risk events where a user’s valid credentials are marked as leaked. Leaked credentials enable attackers to attempt reuse for sign-in and subsequent account access, making timely alerting important. It relies on Azure risk detection telemetry, specifically events with riskEventType set to leakedCredentials.

Known false positives

  • A rare hash collision.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.