LoFP / automation account has been blocked or disabled

Techniques

• t1078
• t1078.004

Sample rules

Account Disabled or Blocked for Sign in Attempts

• source: sigma
• technicques:
  • t1078
  • t1078.004

Description

Detects when an account is disabled or blocked for sign in but tried to log in

Detection logic

condition: selection
selection:
  ResultDescription: Failure
  ResultType: 50057