Title:
Account Disabled or Blocked for Sign in Attempts
Status:
test
Description:Detects when an account is disabled or blocked for sign in but tried to log in
References:
-https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
Author: Yochana Henderson, '@Yochana-H'
Date: 2022-06-17
modified:None
Tags:
- -'attack.privilege-escalation'
- -'attack.persistence'
- -'attack.initial-access'
- -'attack.stealth'
- -'attack.t1078.004'
Logsource:
- product: azure
- service: signinlogs
Detection:
selection:
ResultType:
'50057'
ResultDescription:
'Failure'
condition:
selection
Falsepositives:
-Account disabled or blocked in error
-Automation account has been blocked or disabled
Level:
medium
