Password Spraying - Single IP, Multiple Failed Users
This rule detects password spraying attacks where a single IP address attempts to authenticate against multiple unique user accounts within a specified time window, resulting in failed sign-in attempts. It specifically looks for a high number of unique users failing authentication from the same IP, which is characteristic of password spraying to avoid account lockouts.
Microsoft Sentinel (KQL)
