n-ten.dll SMB credential brute-forcing and domain user enumeration
Detects instances where the specific DLL 'n-ten.dll' is loaded by a process on a device that has experienced five or more failed network logon attempts within a one-hour window. This behavior potentially indicates an adversary attempting to gain access to a host via credential brute force followed by the execution of a custom or malicious library.
Microsoft Sentinel (KQL)
