Detect Disabled Account Sign-in Attempts by IP Address

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query searches for failed sign-in attempts to disabled accounts summarized by the IP originating IP address.

Attribute	Value
Type	Hunting Query
Solution	Cloud Identity Threat Protection Essentials
ID	0cd51b2e-d3b2-4001-8e3f-5cbb604f69b2
Tactics	InitialAccess
Techniques	T1078
Required Connectors	AzureActiveDirectory
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SigninLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Cloud Identity Threat Protection Essentials