Failed Login Attempt by Expired account
'This query looks at Account Logon events found through Windows Event Id's as well as SigninLogs to discover login attempts by accounts that have expired.'
Microsoft Sentinel (KQL)

'This query looks at Account Logon events found through Windows Event Id's as well as SigninLogs to discover login attempts by accounts that have expired.'

Already have an account?