huntrule

Azure Sign-in Logs: Detect Account Lockout After Too Many Failed Password or User Attempts

Flags Azure sign-in events where accounts are locked due to excessive failed logons from wrong user ID or password.

FreeUnreviewedSigmamediumv1
title: "Azure Sign-in Logs: Detect Account Lockout After Too Many Failed Password or User Attempts"
id: 5c9c517d-69a6-400c-b1d1-4c8051cf535d
status: test
description: Identifies user accounts that have been locked after repeated sign-in failures caused by an incorrect user ID or password. Attackers may trigger lockouts to disrupt access or to probe account validity before attempting other credential access techniques. The rule relies on Azure sign-in log events where the sign-in result indicates account lockout (ResultType 50053).
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_account_lockout.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 50053
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
    type: derived

What it detects

Identifies user accounts that have been locked after repeated sign-in failures caused by an incorrect user ID or password. Attackers may trigger lockouts to disrupt access or to probe account validity before attempting other credential access techniques. The rule relies on Azure sign-in log events where the sign-in result indicates account lockout (ResultType 50053).

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.