LDAP brute-force/spray against Global Catalog port 3268 (Cavern LdapBrute)
Detects high-volume or multi-account failed LDAP simple-bind authentication attempts against the Active Directory Global Catalog port (3268). This behavior is consistent with automated password spraying or brute-force tools, such as the Cavern Manticore LdapBrute module, which attempt to validate credentials across multiple accounts.
Microsoft Sentinel (KQL)
