Azure AD Sign-In Logs: Account Locked After Too Many Failed Password/User ID Attempts

Flags Azure sign-in events where accounts are locked due to excessive failed logons from wrong user ID or password.

FreeReviewedSigma · Medium · v5

Product: azure
Service: signinlogs
Author: AlertIQ (SigmaHQ), DRL 1.1
Published: 2021-10-10
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags sign-in events where a user account becomes locked after repeated failed authentication attempts due to an incorrect user ID or password. Lockouts are a common attacker impact mechanism during credential guessing because they can be used to force account state changes and disrupt access. It relies on Azure sign-in telemetry indicating the ResultType associated with account lockout (50053).

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

AWS CloudTrail ConsoleLogin Failed authentication

Azure AD Sign-In Logs: Account Locked After Too Many Failed Password/User ID Attempts

Pivot detection · T1110 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-sign-in-logs-detect-account-lockout-after-too-many-failed-password-or-user-2b7d6fc0

title: "Azure AD Sign-In Logs: Account Locked After Too Many Failed Password/User ID Attempts"
id: 5c9c517d-69a6-400c-b1d1-4c8051cf535d
status: test
description: This rule flags sign-in events where a user account becomes locked after repeated failed authentication attempts due to an incorrect user ID or password. Lockouts are a common attacker impact mechanism during credential guessing because they can be used to force account state changes and disrupt access. It relies on Azure sign-in telemetry indicating the ResultType associated with account lockout (50053).
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_account_lockout.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 50053
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL