MITRE ATT&CK Technique
T1110.001
1 query tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules / Failed Logins
Failed Login Attempts
3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.