1200kmSECURITY RESEARCH

1200KM / sigma-rule

Account Lockout — Sigma Rule

Sigma rule 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a. Account Lockout — Sigma Rule. Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Rule metadata and linked tags

Author: AlertIQ. Source status: test; severity: medium. Source dates: 2021-10-10 / 2022-12-25.

{
  "product": "azure",
  "service": "signinlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 487d1f4adab7eaec3366bcdc05b0c79ad8659261cec40c9aeafae94a2ca8f88f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Account Lockout
id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
status: test
description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-25
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 50053
    condition: selection
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

  • Unknown

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.