Failed Logon to Disabled Account - Credential Reuse or Targeted Access

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects repeated authentication failures (Event ID 4625) with a specific sub-status code 0xC0000072, which indicates that the user account is disabled. This behavior is indicative of a brute-force or credential-stuffing attack against disabled accounts, or potentially misconfigured automated services attempting to authenticate with stale credentials.