Detections
Analytics

CSCv7|16.12

Title

Monitor Attempts to Access Deactivated Accounts

Description

Monitor attempts to access deactivated accounts through audit logging.

Reference Item Details

Category: Account Monitoring and Control

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v3.0.0 L1
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v3.0.0 L1 + BL
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v3.0.0 L1
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v3.0.0 L1 NG
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v3.0.0 L1
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v3.0.0 L1
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v3.0.0 L1 BL NG
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2019 Stand-alone v2.0.0 L1 MS
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 EMS Gateway v3.0.0 L1
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v3.0.0 L1 + BL
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v3.0.0 L1 + NG
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v3.0.0 L1 BL
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v3.0.0 L1 + BL
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v3.0.0 L1 + BL + NG
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Microsoft Windows Server 2019 v3.0.0 L1 Member Server
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Windows Server 2012 MS L1 v3.0.0
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Microsoft Windows Server 2016 v3.0.0 L1 MS
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Microsoft Windows Server 2019 v3.0.1 L1 MS
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Windows Server 2012 R2 MS L1 v3.0.0
1.2.3 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Microsoft Windows Server 2022 v3.0.0 L1 Member Server
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + BL + NG
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + BL
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + BL + NG
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1 + NG
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + NG
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v2.0.0 L1
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v2.0.0 L1
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 EMS Gateway v2.0.0 L1
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Stand-alone v2.0.0 L1
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 10 Enterprise v2.0.0 L1 + BL
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2016 MS L1 v2.0.0
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Enterprise v2.0.0 L1 + BL
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2022 v2.0.0 L1 MS
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows 11 Stand-alone v2.0.0 L1 + BL
1.2.3 Ensure 'Allow Administrator account lockout' is set to 'Enabled' (MS only)WindowsCIS Microsoft Windows Server 2019 MS Standalone L1 v1.0.0
1.2.4 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2016 STIG v2.0.0 L1 MS
1.2.4 (L1) Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 L1 MS
1.2.4 Ensure 'Allow Administrator account lockout' is set to 'Enabled'WindowsCIS Microsoft Windows Server 2022 STIG v1.0.0 L1 MS
1.5.2 Log all Successful and Failed Administrative LoginsCiscoCIS Cisco NX-OS L1 v1.0.0
1.5.2 Log all Successful and Failed Administrative LoginsCiscoCIS Cisco NX-OS L2 v1.0.0
1.6.2 Log all Successful and Failed Administrative LoginsCiscoCIS Cisco NX-OS L2 v1.1.0
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2016 STIG v2.0.0 STIG DC
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2019 v3.0.1 L1 MS
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2019 v3.0.0 L1 Member Server
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows Server 2019 STIG v2.0.0 STIG MS
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Windows Server 2012 R2 DC L1 v3.0.0
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows 10 Enterprise (Release 1803) v1.5.0 Level 1
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Microsoft Windows 8.1 v2.4.0 L1 Bitlocker
17.1.1 (L1) Ensure 'Audit Credential Validation' is set to 'Success and Failure'WindowsCIS Azure Compute Microsoft Windows Server 2019 v1.0.0 L1 MS