Azure AD Account Credential Leaked
This rule detects when an Azure AD user's credentials have been identified as leaked. This detection is based on the 'leakedCredentials' risk event type reported by Azure AD Identity Protection, indicating that the user's valid credentials (e.g., username and password) have been found on the dark web or other publicly available sources.
Sigma
