MT.1080: Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.

ID	MT.1080
Severity	Medium
Suite	Mito
Product	Defender
Feature	Exposure Management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Medium
MITRE ATT&CK	T1539, T1528
Reads from	Microsoft Graph

What this checks and how to fix it

Exfiltration of authentication artifacts on vulnerable device poses a significant security risk. Attackers who gain access to these credentials (e.g., by infostealer) can impersonate privileged users, bypass Conditional Access, and access sensitive the assigned sensitive roles. Protecting endpoints, especially used by privileged users, is essential to prevent unauthorized access and reduce attack surface.

How to fix

Review the details of risk and exposure score on the related device page from the Device Inventory in the Microsoft Defender XDR portal to improve the device’s security posture.

---

Mito check. Author: Cloud-Architekt. Open-source licences.