Use Case: Identity
Compromised credential detection
Valid username and password. Fresh login from a known location. The only problem: the credential was sold on a criminal forum three weeks ago.
The silent entry
Compromised credential abuse is the leading initial access vector in cloud breaches. Unlike brute force, it leaves no failed login attempts. Unlike phishing, it requires no malware. The credential is valid, the login succeeds, and every authentication event looks identical to a legitimate user session — because it is one, behaviorally speaking.
The detection challenge is correlation: matching a breach dataset entry to a live login event in real time, while also evaluating whether the behavioral context of that login is consistent with the legitimate user. ManySignal does both simultaneously — breach-list lookup at authentication time plus behavioral anomaly scoring against the user's 90-day baseline.
rule: compromised_credential_use
type: correlation + enrichment
trigger:
- event: authentication.success
- condition: hibp_breach_check(user.email) == true
OR spycloud_match(user.email, credential_hash) == true
- AND behavioral_anomaly_score > 40
enrichments:
- breach_source: hibp, spycloud, flare
- behavioral_baseline: login_time, device, ip_asn
- post_auth_activity: m365_audit, okta_events
mitre: T1078 (Valid Accounts)Is this credential present in any known breach dataset (HIBP, SpyCloud, or dark web feed)?
Breach intelWhen was the last successful login before this event, and from what location?
IdP baselineHas the user's password been changed in the last 30 days?
Directory auditDid the authentication come from a known residential proxy or anonymization service?
IP reputationWhat resources did the user access in the first 10 minutes post-login?
Activity logAre there other accounts in this organization with the same password hash pattern?
AD / EntraForce password reset on next login via IdP policy
AutonomousNotify user via email and Slack with context on the suspected compromise
AutonomousIf post-auth activity includes mail export or file download: suspend account immediately
Approve-gatedSubmit credential to SpyCloud and Recorded Future for campaign attribution
RecommendLegacy SOC comparison
Without breach-list correlation at login time, the only signal is behavioral deviation. Most SIEMs require manual IOC lookup, which happens hours after the fact — if at all. The credential may be used dozens of times before an analyst notices the pattern.
MITRE ATT&CK mapping
Compromised credentials FAQ
How does ManySignal check for compromised credentials without storing plaintext passwords?
ManySignal uses k-anonymity API calls to HIBP and SpyCloud using truncated SHA-1 hash prefixes. No plaintext or full hash is transmitted. For on-premises AD, ManySignal integrates with Microsoft's NTLM hash exposure check (DSRM) and Purple Knight-style posture analysis.
Can this detection work for service accounts, not just human users?
Yes. Service account credentials can appear in breach datasets when they're stored in code repositories, CI/CD environment variables, or configuration files. ManySignal monitors service account authentication for the same breach-correlation signals.
What's the false positive rate for this detection?
Across customer deployments, the false positive rate for the combined breach-list plus behavioral signal is under 3%. The primary false positives are users sharing an email address across personal and work accounts, which appears as a breach when only the personal credential was leaked.
Does ManySignal scan the dark web for credentials?
ManySignal integrates with SpyCloud, Flare, and Hudson Rock for dark web credential monitoring. These feeds provide real-time notifications when credentials from your domain appear in new breach datasets or criminal marketplaces.
Catch credential abuse at login time
Connect your IdP and breach intel feeds in one session. See real matches against your user base.