Invalid Users Failing To Authenticate From Single Source Using NTLM

Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.