3BB: SSH password spraying from single host against many internal targets
Detects anomalous, high-volume authentication failures originating from a single source IP address targeting multiple distinct internal devices within a short timeframe. This behavior is indicative of a password spraying or brute-force attack.
Microsoft Sentinel (KQL)
