Logon Failure - Specified account expired

Description

field win.system.eventID="^532$"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60001 Group of Windows rules for the security channel. anchor level 0
   field win.system.channel="^Security$"
3. 60104 Windows audit failure event anchor level 5
   field win.system.severityValue="^AUDIT_FAILURE$|^failure$"
4. 60105 Windows Logon Failure anchor level 5
   field win.system.eventID="^529$|^530$|^531$|^532$|^533$|^534$|^535$|^536$|^537$|^539$|^4625$"
5. 60125 Logon Failure - Specified account expired refinement level 5 this rule
   field win.system.eventID="^532$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 60105
  • Windows Logon Failure