AD Account Lockout

Description

'Detects Active Directory account lockouts'

Query · kql

SecurityEvent
| where EventID == 4740
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), LockoutsCount = count() by Activity, Account, TargetSid, TargetDomainName, SourceComputerId, SourceDomainController = Computer
| extend timestamp = StartTime, AccountCustomEntity = Account, HostCustomEntity = TargetDomainName
Raw source AD Account Lockout · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: e7642e6e-cf27-46ec-a4b9-e4475228fead
name: AD Account Lockout
description: |
  'Detects Active Directory account lockouts'
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
tactics:
  - Impact
relevantTechniques:
  - T1531
query: |
  SecurityEvent
  | where EventID == 4740
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), LockoutsCount = count() by Activity, Account, TargetSid, TargetDomainName, SourceComputerId, SourceDomainController = Computer
  | extend timestamp = StartTime, AccountCustomEntity = Account, HostCustomEntity = TargetDomainName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.