Disabled or Blocked Account Sign-in Attempt
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Sigma
