Password spray followed by successful non-UK sign-in
Detects potential password spraying activity characterized by a high number of distinct IP addresses failing authentication for a specific user, followed shortly by a successful authentication for that same user from a geographic location outside the United Kingdom.
Sigma
