Password Spray Using Kerberos Pre-Auth
This query detects Kerberos pre-authentication attempts where the captured source address is external. You can tweak and remove the RFC's to also look at internal requests, but expect some noise. In addition, you might want to tweak the counter.
Cortex XDR
