123
Massive breach spills credentials for thousands of sensitive networks
(arstechnica.com)
This is a most excellent place for technology news and articles.
Oh they absolutely show up in logs. And if they're half competent, this also would cause MFA prompts to users... And lockouts... So IT tickets too.
Yet...
*crickets*
There's often no MFA configured for infrastructure because teams don't want to bother and think their own stuff is secure.
What it should definitely cause is SIEM alerts.