> Source: [sk184172](https://support.checkpoint.com/results/sk/sk184172)

# sk184172 - Clarification on Credential Leak Detection Alerts

| Property | Value |
|----------|-------|
| Solution ID | sk184172 |
| Date Created | 2025-10-14 |
| Last Modified | 2025-10-22 |
| Technical Level | General |
| Products | External Risk Management |
| Versions | Cloud |

## Symptoms

- There are multiple alert types related to credential leak detection, and the distinctions between them are unclear. While credential leak detection is known to operate within the Threat Intelligence (TI) domain, detection results also show alerts originating from Attack Surface Management (ASM) --- including cases where detections are generated solely by ASM. This raises uncertainty about whether credential leak detection operates independently within ASM using its own detection logic, in addition to TI-based detections.

## Solution

This SK article explains the different types of credential leak alerts, outlines the differences between TI and ASM detection logic, and provides examples to illustrate their operation.
**Note** : This article focuses only on credential leak alerts. It does not include alerts related to credentials offered for sale or infected employee machines, which are classified as separate alert types.  

Show the Entire Section

Credential Leak Detection Alert Types
-------------------------------------

The ERM platform includes three automated alert types related to credential leaks. Each type reflects a different exposure type and detection logic:

**1. Compromised Employee Corporate Credentials Exposed**  
This alert covers cases where employee credentials for corporate systems are found exposed, whether detected by Threat Intelligence (TI) or Attack Surface Management (ASM).  
**Detection Logic**   

* Credentials are analyzed in `URL:Login:Pass (ULP)` format to determine if they belong to corporate systems.
* Credentials are classified as **Corporate** when:
  * The URL matches a registered employee login interface asset.
  * The username contains a corporate domain that also appears in the login URL.

**Detection Sources**   

* **Threat Intelligence (TI)**: Credentials collected from external sources (For example, malware logs, Telegram dumps, or breach databases).
* **Attack Surface Management (ASM)**: Credentials identified by scanning known domains and employee login assets.
* **Login Interface Scanner**: Credentials detected by ERM automated login interface scanner. These generate alerts but not intel items.

**Note** : If both TI and ASM detect the same credential pair, ERM automatically deduplicates the data and generates a single consolidated alert.  
**Example** :  
`user@company.com` : `password123` found on *login.company.com* or within a malware log targeting your corporate VPN.

**2. Compromised Employee Third-Party Credentials Exposed**  
This alert identifies employee credentials leaked through non-corporate or third-party systems, such as SaaS platforms or public websites. These alerts indicate password reuse risks rather than a direct compromise of company assets.  
**Example** :  
`employee@company.com` found in a leaked database from a third-party service (For example, LinkedIn, GitHub).

**3. Company Customer Credentials Exposed**  
This alert identifies customer credentials (not employee credentials) leaked online. These are linked to customer-facing services that match company domains or brand references.  
**Example** :  
Customer credentials for `shop.company.com` found in a malware log.

TI vs ASM Detection Logic
-------------------------

Credential leak detection operates in both Threat Intelligence (TI) and Attack Surface Management (ASM), each using distinct detection methods:**TI Detection** :  
Identifies exposures from external sources, such as malware logs, dumps, and breach repositories. Provides real-time detection as new data becomes available.  
**ASM Detection** :  
Focuses on internal asset scanning, monitoring known domains and login interfaces. These findings are aggregated periodically rather than triggered immediately.  
**Note** : When both TI and ASM detect the same credentials, ERM automatically merges the findings into a single unified alert referencing both sources.  

Summary
-------

* **Corporate Credentials Exposure** -- Employee credentials for internal systems (via TI, ASM, or Login Interface Scanner).
* **Third-Party Credentials Exposure** -- Employee credentials leaked on external, non-corporate services.
* **Customer Credentials Exposure** -- Customer login credentials exposed online.

**Key points:**   

* Both TI and ASM detect credential leaks, using independent detection logic while sharing deduplication.
* ERM automatically performs deduplication to prevent duplicate alerts for the same credentials.
* Login Interface Scanner alerts may not create intel items but generate alerts for visibility.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content