Sure, here are some examples. These are all AD attributes. You can filter on most of the attributes that make sense to do so, with a few quirks – "EmailAddress" won't work, but "mail" does, for example.
Richard, can you elaborate please? I'm not seeing the flaw in my logic.
If the current value of the attribute is 514 (account disabled) and the LastOriginatingChangeTime property of the attribute shows the date/time of the last change to the attribute, under what circumstances might it not represent the date/time when the account was disabled?