• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Privileged Accounts Locked Out

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•2•0•28

    'Identifies privileged accounts that have been locked out. Verify these lockout are due to legitimate user activity and not due to threat actors attempting to access the accounts. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'

    Microsoft Sentinel (KQL)

    Tags

    T1078.004 - Cloud AccountsTA0001 - Initial AccessTA0006 - Credential AccessTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationT1110 - Brute ForceT1110.001 - Password GuessingT1098 - Account ManipulationT1110.002 - Password CrackingT1110.003 - Password SprayingT1110.004 - Credential StuffingCredential AccessAuthentication LockoutAzureAzure Signin LogsAzure Ad Risk Detectionkqltactic:InitialAccesstechnique:T1078.004

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?