Triage queue
// Operations

Password spray from 185.100.200.50 against 24 accounts

A single external address failed authentication against 24 distinct directory accounts inside twelve minutes.

ALT-A61185HighInvestigating
74Elevated

This alert has been escalated. Open the incident to see the full case.

20+ events where eventType is AUTHENTICATION_FAILURE, grouped by sourceIp, within 15 minutes

One source address failing authentication repeatedly inside a short window, consistent with spraying a common password across many accounts.

Triggering event

The exact record that satisfied the rule.

Authentication FailureLow2026-09-04 14:26:53ZWIN-DC01
Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)

What else was happening

Other activity for jmercier in the surrounding hour.

TimeEventSeverityHost
2026-09-04 14:17:17ZAuthentication FailureLowWIN-DC01
2026-09-04 14:18:39ZAuthentication SuccessInfoWS-FIN-002
2026-09-04 14:19:18ZAuthentication SuccessInfoWS-FIN-007
2026-09-04 14:20:29ZAuthentication FailureLowWIN-DC01
2026-09-04 14:23:41ZAuthentication FailureLowWIN-DC01
2026-09-04 14:35:11ZAuthentication SuccessInfoWS-FIN-008
2026-09-04 14:49:48ZAuthentication SuccessInfoWS-FIN-005
2026-09-04 15:17:57ZAuthentication SuccessInfoWS-FIN-010
2026-09-04 15:21:45ZAuthentication SuccessInfoWS-FIN-009

Alert

Raised
7d ago
Last updated
7d ago
Risk score
74
Source
WIN-DC01
Origin
Lahore, Pakistan
Detected by
Correlation rule

Pivot