AD password spray followed by 4720 account creation from same source IP

ills3c Intel&Coffee@Ills3C

•updated today•1•0•19

Detects an Active Directory password spray attack originating from a single source IP, followed closely by a user account creation event (Event ID 4720) associated with a logon from that same source IP.