Password spraying against SMB/Kerberos preceded by username enumeration
Detects password spraying behavior (many accounts targeted with few failures each from the same source IP within a 1-hour window) preceded or accompanied by directory enumeration activity such as SAM-R queries, account enumeration, or LDAP queries from the same source.
Microsoft Sentinel (KQL)
