Disabled Service Account Detection
This rule identifies disabled service accounts within the environment. The goal is to help audit the state of service accounts, identify unused or stale accounts, ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. While not directly indicative of an attack, monitoring disabled service accounts can help identify potential misconfigurations or accounts that could be re-enabled and abused.
Microsoft Sentinel (KQL)
