Failed Logins to Disabled AD Accounts

Identifies multiple failed login attempts to disabled accounts in Active Directory indicating potential unauthorized access attempts.

Microsoft Sentinel (KQL)