# Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints
Exfiltration of authentication artifacts on vulnerable device poses a significant security risk.
Source: https://maester.dev/docs/tests/MT.1080
Part of Maester · Defender · Exposure Management · All checks
```powershell title="Run this check"
Invoke-Maester -TestId MT.1080
```
## Overview
Exfiltration of authentication artifacts on vulnerable device poses a significant security risk. Attackers who gain access to these credentials (e.g., by infostealer) can impersonate privileged users, bypass Conditional Access, and access sensitive the assigned sensitive roles. Protecting endpoints, especially used by privileged users, is essential to prevent unauthorized access and reduce attack surface.
### How to fix
Review the details of risk and exposure score on the related [device page from the Device Inventory](https://learn.microsoft.com/defender-endpoint/machines-view-overview#device-inventory-overview) in the Microsoft Defender XDR portal to improve the device's security posture.
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | MT.1080 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Feature | Exposure Management |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1539 Steal Web Session Cookie, T1528 Steal Application Access Token |
| PowerShell test | [Test-MtXspmExposedCredentialsForPrivilegedUsers](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1080.ps1) |
| Services | Graph |
| Long running | Yes |
## Source
- Test: [`tests/maester/xspm/Test.MT.1080.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1080.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1080.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1080.md)
