Packages / Identity And Session Credentials
Passwords, authentication factors, recovery material, session tokens, and identity-provider secrets.
Detects Microsoft Entra (formerly Azure AD) client access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) client secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) user credential patterns including username/password combinations targeting Microsoft login endpoints. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects documents containing credential-related terminology. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based bundled detector that aggregates multiple credential SITs. This keyword-based version flags documents that may contain credentials for further review.
Detects JWT-shaped values presented with the Bearer authentication scheme. A bare scheme/value pair is discovery-only; an Authorization header enforces at medium confidence and a complete HTTP request or response context reaches high.
Detects documents containing client secret and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad bundled detector. This keyword-based version flags documents that may contain client secrets or API keys for further review.
Detects credential combolist / infostealer-log lines: email:password pairs and host-or-url:user:pass triples, the format in which stolen credentials are aggregated and traded after info-stealer infections. These dumps fuel credential stuffing and account-takeover attacks. A lone email/password candidate is discovery-only; service-bound triples and multi-row dump structure support enforcement.
Detects general password patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain passwords for further review.
Detects HTTP Authorization header patterns containing Bearer tokens, Basic credentials, and other authentication schemes. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects JSON Web Token candidates with three Base64url segments. A generic encoded-JSON candidate is discovery-only; a standard encoded algorithm header plus encoded JSON payload enforces at medium confidence, and HTTP or session transport binding raises the result to high confidence.
Detects high-value session cookies by name-plus-value: framework and SSO session cookies (ESTSAUTH / ESTSAUTHPERSISTENT, JSESSIONID, PHPSESSID, connect.sid, _session_id, sessionid) assigned a long token value. A captured session cookie lets an attacker resume an authenticated session and bypass MFA entirely. Bare assignments are discovery-only; HTTP cookie framing and response attributes provide the enforcement tiers.
Identifies plaintext passwords patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies password hash databases patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects password reset tokens and recovery URLs in documents, emails, and logs. Reset tokens are high-risk credentials — a leaked token enables account takeover without knowing the current password. No Microsoft built-in SIT exists for this pattern.
Identifies multi-factor authentication seeds patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies one-time recovery codes patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies oauth client secrets patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies session cookies patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies kerberos ticket-granting artifacts patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies documents containing references to customer account credentials in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects user login credential patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain login credentials for further review.