Permutations on logon attempts by UserPrincipalNames indicating potential brute force
'This identifies failed logon attempts using permutations based on known first and last names within 10m time windows. Iteration through separators or order changes in the logon name may indicate potential Brute Force logon attempts.'
Microsoft Sentinel (KQL)
