Hunt for Leaked Credentials
This KQL query searches the ExposureGraphNodes table in Microsoft Defender XDR or Sentinel to identify user accounts whose credentials have been leaked. It focuses on nodes categorized as "identity" and labeled as "user", then extracts detailed identity-related properties such as: Display name, UPN, email address, Account status (enabled/disabled), Job title, department, phone, address, Source provider (e.g., Azure AD, on-prem AD), Account creation time, and whether the account's credentials have been leaked. The query filters and enriches this data, and presents it in a clean, readable format for hunting or triage.
Microsoft Sentinel (KQL)
