Skip to main content
Tier One
Medium

Disabled employee account attempts VPN sign-in

A-1068

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
SIEM Correlation
Detection rule
SIEM-IDENT-DISABLED-011
Affected user
b.harlow
Affected host
SRV-DC-01
Source IP
77.91.101.220
First seen
2026-07-24T18:02:00Z

Why this fired, in plain English

Someone tried to sign in with an account that had already been switched off.

Suggested playbook

Credential brute force & password spray

  1. 1. Identify the source IP. Internal (10.20.0.0/16) or external?
  2. 2. Check for a 4624 success from the same source after the failures.
  3. 3. Check status codes: 0xC000006A = bad password, 0xC0000072 = disabled account, 0xC0000234 = locked out.
  4. 4. Look for a 4723/4724 password change just before internal failures — cached credentials cause noise.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T18:00:41Z host=SRV-DC-01 EventID=4625 account="b.harlow" src_ip=77.91.101.220 logon_type=3 status=0xC0000072 failure_reason="account disabled"

    Status 0xC0000072 specifically means the account exists but is disabled.

  2. Guided hint: this line matters

    ts=2026-07-24T18:01:10Z src="vpn" event=auth_fail user="b.harlow" client_ip=77.91.101.220 attempts=5 reason="account disabled"

  3. Guided hint: this line matters

    ts=2026-07-24T18:01:55Z src="hris" event=lookup user="b.harlow" employment_status="terminated" last_day="2026-06-30" offboarding_ticket="OFF-2210" account_disabled="2026-06-30T22:00Z"

    The person left the company four weeks ago and offboarding was completed correctly.

Related events

The order things happened in.

  1. 18:00Z

    Failed domain logon (account disabled)

  2. 18:01Z

    5 failed VPN attempts from a foreign IP

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 2 lookups checked

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.