Skip to main content
Version: 2.1.1-preview

MT.1080 - Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints

Overview​

Exfiltration of authentication artifacts on vulnerable device poses a significant security risk. Attackers who gain access to these credentials (e.g., by infostealer) can impersonate privileged users, bypass Conditional Access, and access sensitive the assigned sensitive roles. Protecting endpoints, especially used by privileged users, is essential to prevent unauthorized access and reduce attack surface.

How to fix​

Review the details of risk and exposure score on the related device page from the Device Inventory in the Microsoft Defender XDR portal to improve the device's security posture.

Test Metadata​

FieldValue
Test IDMT.1080
SeverityMedium
SuiteMaester
CategoryPrivileged
PowerShell testTest-MtXspmExposedCredentialsForPrivilegedUsers
TagsEntra, EntraOps, Graph, LongRunning, MT.1080, Privileged, XSPM

Source​

  • Pester test: tests/XSPM/Test-XspmPrivilegedIdentities.Tests.ps1
  • PowerShell source: powershell/public/xspm/Test-MtXspmExposedCredentialsForPrivilegedUsers.ps1