Account Lockout

Status: test
Severity: medium
Log source: product azure, service signinlogs
Author: AlertIQ
Source: github.com/SigmaHQ/sigma

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Sign-in blocked by account lockout

Rules detecting the same action

These rules filter on the same operation.

Azure Excessive Account Lockouts (Panther)
Entra ID Excessive Account Lockouts Detected (Elastic)

Rule body

title: Account Lockout
id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
status: test
description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-25
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 50053
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ResultType: 50053

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResultType`	eq	`50053`	`field:"ResultType" kind:eq value:"50053"`