Windows Unusual NTLM Authentication Destinations By Source

The analytic detects when an unusual number of NTLM authentications is attempted by the same source against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to multiple domain-joined Windows devices using an NTLM-based process/attack. This same activity may also generate a large number of EventID 4776 events as well.