APT28 NTLM Password Spray - Multiple Account Failures from Single IP

Ankit Mehta@Secvyn

•updated Jun 29, 2026•2•0•6

Detects a potential brute force or password spraying attempt by identifying high volumes of NTLM logon failures (Event ID 4625) originating from a single IP address, targeting multiple distinct user accounts within a 10-minute window.