TeamFiltration-style AWS EC2 IP-rotation password spray
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Microsoft Sentinel (KQL)
