SpyCloud plaintext credential exposure detected

id: a25eba0e-ff42-4c97-a379-d76bdb2aa1e3
name: SpyCloud plaintext credential exposure detected
description: |
  'Identifies user accounts exposed with a plaintext password in a third-party data breach.
  Unremediated exposures of this kind can lead directly to account takeover.'
severity: High
requiredDataConnectors:
  - connectorId: SpyCloudEnterpriseProtectionCCF
    dataTypes:
      - SpyCloudBreachWatchlistV2_CL
queryFrequency: 1h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1555
query: |
  // Human-readable constant for the severity threshold used below
  let severityThreshold = 20;
  SpyCloudBreachWatchlistV2_CL
  | where Severity == severityThreshold
  | mv-expand IPAddress = IPAddresses to typeof(string)
  | extend AccountName = Username, AccountEmail = Email
  | project TimeGenerated, DocumentId, SourceId, SpyCloudPublishDate, AccountEmail,
      TargetDomain, PasswordPlaintext, AccountName, IPAddress
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: AccountEmail
version: 1.0.0
kind: scheduled