Distributed password spray with legacy-auth against many accounts

Ankit Mehta@Secvyn

•updated Sep 27, 2026•15•0•19

This rule detects potential password spraying activity by monitoring for a single source IP address that targets multiple distinct user accounts with failed authentication attempts. It specifically identifies 'low-and-slow' patterns that may attempt to evade standard lockout thresholds, and flags cases where legacy authentication protocols are utilized, a technique commonly employed to bypass Multi-Factor Authentication (MFA).