Windows Password Spray Attack Detection
This rule detects repeated authentication failures from a single hostname targeting multiple distinct user accounts within a 30-minute window. This behavior is indicative of a password spraying attack, where an adversary attempts to use a small set of common passwords against many accounts to avoid account lockouts on a single account.
YARA-L
