Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Sign-ins from IPs that attempt sign-ins to disabled accounts

Identifies IPs with failed attempts to sign in to one or more disabled accounts using the IP through which successful signins from other accounts have happened. This could indicate an attacker who obtained credentials for a list of accounts and is attempting to login with those accounts, some of which may have already been disabled. References: https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes 50057 - User account is disabled. The account has been disabled by an administrator. This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.

ATT&CK coverage

Initial Access

T1078Valid AccountsAlso under Persistence, Privilege Escalation, and Stealth.650 detections cover this technique

Persistence

T1098Account ManipulationAlso under Privilege Escalation.375 detections cover this technique

Detection requirements

Log source product: azureactivedirectory behavioranalytics
Log source service: aadnoninteractiveusersigninlogs behavioranalytics signinlogs

What the source says

Tagged by the source as

InitialAccessPersistence

Detection catalogue

Sign-ins from IPs that attempt sign-ins to disabled accounts

ATT&CK coverage

Detection requirements

What the source says

Tagged by the source as

Detection logic

Sign-ins from IPs that attempt sign-ins to disabled accounts

ATT&CK coverage

Detection requirements

What the source says

Tagged by the source as

Detection logic