Detect Distributed Password Spray Attempts

This analytic identifies distributed password spray attacks by using a 3-sigma statistical approach. It detects scenarios where an attacker attempts a few common passwords against many different accounts from multiple IP addresses to evade detection. The detection leverages CIM-mapped authentication events for comprehensive coverage.