Hunt for accounts with leaked credentials

Group by: AccountObjectId
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This query searches for accounts where Exposure Management detected leaked credentials. This query is correlated with the IdentityInfo table, mainly because you can easily create a detection of this rule if you would like to.

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`ExposureGraphNodes` action `any`: Exposure graph nodes
Microsoft Defender for Endpoint	`IdentityInfo` action `any`: Identity information

Rule body

IdentityInfo
| summarize arg_max(TimeGenerated, AccountUpn, AccountDisplayName, AccountDomain, CriticalityLevel, DistinguishedName) by AccountObjectId
| join kind=inner (
    ExposureGraphNodes
    // Get accounts with Leaked Credentials
    | where NodeProperties.rawData.hasAdLeakedCredentials == "true" or NodeProperties.rawData.hasLeakedCredentials == "true"
    // Get the AAD Object ID
    | mv-expand EntityIds
    | where EntityIds.type == "AadObjectId"
    | extend AccountObjectId = extract('objectid=(.*)', 1, tostring(EntityIds.id))
    | extend HasAdLeakedCredentials = tostring(NodeProperties.rawData.hasAdLeakedCredentials),
        HasLeakedCredentials = tostring(NodeProperties.rawData.hasLeakedCredentials)
    | distinct NodeLabel, AccountObjectId, HasAdLeakedCredentials, HasLeakedCredentials
) on AccountObjectId

Stages and Predicates

Stage 1: `source`

IdentityInfo

Stage 2: `summarize`

| summarize arg_max(TimeGenerated, AccountUpn, AccountDisplayName, AccountDomain, CriticalityLevel, DistinguishedName) by AccountObjectId

Stage 3: `join`

| join kind=inner (
    ExposureGraphNodes
    | where NodeProperties.rawData.hasAdLeakedCredentials == "true" or NodeProperties.rawData.hasLeakedCredentials == "true"
    | mv-expand EntityIds
    | where EntityIds.type == "AadObjectId"
    | extend AccountObjectId = extract('objectid=(.*)', 1, tostring(EntityIds.id))
    | extend HasAdLeakedCredentials = tostring(NodeProperties.rawData.hasAdLeakedCredentials),
        HasLeakedCredentials = tostring(NodeProperties.rawData.hasLeakedCredentials)
    | distinct NodeLabel, AccountObjectId, HasAdLeakedCredentials, HasLeakedCredentials
) on AccountObjectId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`hasAdLeakedCredentials`	eq	`true`	`field:"hasAdLeakedCredentials" kind:eq value:"true"`
`hasLeakedCredentials`	eq	`true`	`field:"hasLeakedCredentials" kind:eq value:"true"`
`type`	eq	`AadObjectId`	`field:"type" kind:eq value:"AadObjectId"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountObjectId`	`summarize`