It shows in logs as many failed logins for many different users from one address in a short time. Rate limits and breached-password checks reduce it; detection rules tell you it is happening.