Azure AD Sign-in Attempts to Disabled Accounts

title: Azure AD Sign-in Attempts to Disabled Accounts
id: 8f826078-84b5-4817-ac00-ae7747e4d52b
status: test
description: This rule flags sign-in log entries where the authentication result indicates the target user account is disabled. Attackers may try to access accounts that have been disabled to probe identity status or bypass controls, making these attempts useful for spotting suspicious login activity. It relies on Azure sign-in log telemetry, specifically the sign-in result type and its description indicating the account is disabled.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 50057
    ResultDescription: User account is disabled. The account has been disabled by an administrator.
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8
    type: derived