Account Enabled (Microsoft Defender for Identity)
Detects when a previously disabled user account is re‑enabled in Active Directory. While this may be part of normal administrative activity, it can also indicate an attempt to restore access to an account for unauthorized use and should be reviewed.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.module = "defender-identity"
| Vendor.category = "AdvancedHunting-IdentityDirectoryEvents"
| event.action = "account enabled"
| #event.outcome = "success"
| table([@timestamp,user.name,user.target.name,Vendor.properties.AccountUpn,Vendor.properties.TargetAccountUpn])Detects when a previously disabled user account is re‑enabled in Active Directory. While this may be part of normal administrative activity, it can also indicate an attempt to restore access to an account for unauthorized use and should be reviewed.
account_enabled_microsoft_defender_for_identity.yml
T1078
Kundan Kumar
Detection
Identity
Identity
2026-05-21
2026-05-21
