Password spraying followed by internal network scanning from same source
Detects external password spraying activity from a source IP address followed by internal network port scanning or connection attempts originating from a device utilizing that same IP address.
Microsoft Sentinel (KQL)
