Users with leaked credentials

[Peter Nicholson]

Can anyone tell me the logic used in this report? We have a situation where I need to prove one of our users performed a certain action as listed in our 365 audit logs. An obvious argument is that if their account was compromised, it may have been done by a third party using their credentials.

Their account does not appear in this report, so my question is - How much stock can I put in the fact that they do not appear in this report?

[#2 · Accepted solution]

Not sure it will help but here is the official explanation of leaked credentials and how Microsoft matches one of these users:

"When cybercriminals compromise valid passwords of legitimate users, the criminals often share those credentials. This is usually done by posting them publicly on the dark web or paste sites or by trading or selling the credentials on the black market. The Microsoft leaked credentials service acquires username / password pairs by monitoring public and dark web sites and by working with:

• Researchers
• Law enforcement
• Security teams at Microsoft
• Other trusted sources

When the service acquires username / password pairs, they are checked against AAD users' current valid credentials. When a match is found, it means that a user's password has been compromised, and a leaked credentials risk event is created."

This is from here by the way.  This isn't foolproof, it's just what Microsoft can acquire and potentially match.

[#3]

In this statement

"When the service acquires username / password pairs, they are checked against AAD users' current valid credentials. When a match is found, it means that a user's password has been compromised, and a leaked credentials risk event is created."

Does this mean that they are actually comparing passwords / hashes of those found with those in an organisations AD, or are they just matching the username with ones found on lists, and from that deciding the creds are blown?

If they are accessing an organisations Azure password hashes that sounds bad.  If they are not then it sounds like a pretty basic service?