1200KM / sigma-rule
Account Lockout — Sigma Rule
Sigma rule 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a. Account Lockout — Sigma Rule. Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Rule metadata and linked tags
Author: AlertIQ. Source status: test; severity: medium. Source dates: 2021-10-10 / 2022-12-25.
{
"product": "azure",
"service": "signinlogs"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 487d1f4adab7eaec3366bcdc05b0c79ad8659261cec40c9aeafae94a2ca8f88f
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Account Lockout
id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
status: test
description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-25
tags:
- attack.credential-access
- attack.t1110
logsource:
product: azure
service: signinlogs
detection:
selection:
ResultType: 50053
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.