I don't mean misconduct that will make him get expelled or miss his academic requirement. He will have received sanction like making an apology or suspension for a month if the university finds it out earlier. But the student now has graduated and will not be back. Can the university still do something to him?
This depends entirely on what the misconduct was and the university in question. One extreme case is Jan Hendrik Schon where he published many articles using fabricated data. The University of Konstanz revoked his degree after the subsequent investigation of academic dishonorable misconduct. For something like this, the institution that had initially conferred the degree may revoke the degree despite the individual having already graduated.
If the individual has graduated, but has not yet been issued the degree, and depending on the severity of the misconduct, the university may also withhold the degree until further notice.
Overall, it really depends on the university's judgment on how severe the misconduct was. There are no universal rules regarding how the university ought to punish a student based on the misconduct (e.g., some universities are much more strict about plagiarism or cheating than others).
In the US, I do know people's degree were revoked after they had got it, but this thing rarely happened. At least in my alma mater, it never happened.
Also bear in mind, revoking a student's degree is actually a shame for the university too, because people may question the university that didn't your guys carefully check your students' dissertation before letting them graduate?
As for the reason of revoking a student's degree, I feel it is always the same: Their dissertations are subject to data fabrication or plagiarism. Honestly, plagiarism rarely happened over the course of the past 10 years, because most universities would conduct the plagiarism check immediately after the students submitted their dissertations to graduate school, at least in my university our dissertations are subject to plagiarism check using Turnitin software. But data fabrication, it is really hard to know at the first hand.