Disabled Account Re-Enabled - Potential Dormant or Backdoor Account Restoration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•5

This rule detects when a previously disabled Active Directory user account is re-enabled. Monitoring for account enablement is critical as it can be a sign of an adversary reactivating a dormant or service account to maintain persistence or conduct lateral movement.