Cross-APT Password Spray - Multiple Failed Logons from Single IP
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Microsoft Sentinel (KQL)
