General

This alarm is triggered when someone attempts to log in to an account that is disabled.

Rationale

Such a login attempt may indicate that a password has been leaked or serve as an indication that a (former) employee is attempting to gain access to computer systems. In both cases, it is advisable to change the password.

Follow-up

Perform these steps to adequately follow up on this detection:

1. Change the password of the account in question
2. Verify with the user in question whether the login attempt was intentional
   
   
   1. If Yes:
      
      1. Explain that access has been denied for a reason
   2. If No:
      1. Advise further investigation