Windows Unusual NTLM Authentication Destinations By User

This analytic detects an unusual number of NTLM authentication attempts by a single user account against multiple distinct destinations. This behavior is indicative of an attacker performing brute-force attacks, password spraying, or other NTLM-based authentication attacks to gain access to numerous domain-joined Windows devices. Such activity may also generate a high volume of Event ID 4776 events.