Detectionmediumtest

Account Disabled or Blocked for Sign in Attempts

Detects when an account is disabled or blocked for sign in but tried to log in

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Yochana HendersonCreated Fri Jun 174afac85c-224a-4dd7-b1af-8da40e1c60bdcloud

Log Source

Azuresigninlogs

ProductAzure← raw: azure

Servicesigninlogs← raw: signinlogs

Detection Logic

detection:
    selection:
        ResultType: 50057
        ResultDescription: Failure
    condition: selection

False Positives

Account disabled or blocked in error

Automation account has been blocked or disabled

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

4afac85c-224a-4dd7-b1af-8da40e1c60bd

Status

test

Level

medium

Type

Detection

Created

Fri Jun 17

Author

Path

rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.defense-evasionattack.initial-accessattack.t1078.004