Azure Entra Sign-In Logs: Account Disabled or Blocked on Failed Login Attempts

title: "Azure Entra Sign-In Logs: Account Disabled or Blocked on Failed Login Attempts"
id: f0dbd13b-4444-43f8-9a1e-f48d260bc0c1
status: test
description: This rule flags sign-in failures where the result indicates the account was disabled or blocked in response to a sign-in attempt. Attackers may use repeated login attempts against disabled/blocked accounts to probe controls, test identity configurations, or persist via credential and account handling errors. It relies on Azure sign-in log telemetry (ResultType and ResultDescription) captured in sign-in logs.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml
author: Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-06-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 50057
    ResultDescription: Failure
  condition: selection
falsepositives:
  - Account disabled or blocked in error
  - Automation account has been blocked or disabled
level: medium
license: DRL-1.1
related:
  - id: 4afac85c-224a-4dd7-b1af-8da40e1c60bd
    type: derived