• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Failed Login Attempt by Expired account

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•5•0•59

    'This query looks at Account Logon events found through Windows Event Id's as well as SigninLogs to discover login attempts by accounts that have expired.'

    Microsoft Sentinel (KQL)

    Tags

    T1078 - Valid AccountsTA0001 - Initial AccessTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationAuthentication FailureLogon EventWindowsAzureWindows Eventlog SecurityAzure Signin LogsWindows KerberosWindows Ntlm Authkqltactic:InitialAccesstechnique:T1078

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?