Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.[1] Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.[2] Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.[2] |
| G1030 | Agrius |
Agrius engaged in various brute forcing activities via SMB in victim environments.[3] |
| G0007 | APT28 |
APT28 can perform brute force attacks to obtain credentials.[4][1][5] |
| G0082 | APT38 |
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[6] |
| G0087 | APT39 | |
| G0096 | APT41 |
APT41 performed password brute-force attacks on the local admin account.[8] |
| S0572 | Caterpillar WebShell |
Caterpillar WebShell has a module to perform brute force attacks on a system.[9] |
| S0220 | Chaos |
Chaos conducts brute force attacks against SSH services to gain initial access.[10] |
| S0488 | CrackMapExec |
CrackMapExec can brute force supplied user credentials across a network range.[11] |
| G0105 | DarkVishnya |
DarkVishnya used brute-force attack to obtain login data.[12] |
| G0035 | Dragonfly |
Dragonfly has attempted to brute force credentials to gain access.[13] |
| G1003 | Ember Bear |
Ember Bear used the |
| G0053 | FIN5 |
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.[15][16] |
| G0117 | Fox Kitten |
Fox Kitten has brute forced RDP credentials.[17] |
| G1001 | HEXANE |
HEXANE has used brute force attacks to compromise valid credentials.[18] |
| S0599 | Kinsing | |
| G0049 | OilRig |
OilRig has used brute force techniques to obtain credentials.[20][21] |
| C0022 | Operation Dream Job |
During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.[22] |
| S0378 | PoshC2 |
PoshC2 has modules for brute forcing local administrator and AD user accounts.[23] |
| S0583 | Pysa |
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[24] |
| S0650 | QakBot |
QakBot can conduct brute force attacks to capture credentials.[25][26][27] |
| G0010 | Turla |
Turla may attempt to connect to systems within a victim's network using |
| ID | Mitigation | Description |
|---|---|---|
| M1036 | Account Use Policies |
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[29] Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.[30] |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services. |
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies.[31] |
| M1018 | User Account Management |
Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. |
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Analytic 1 - Command-line tools used for brute force attacks.
|
| DS0002 | User Account | User Account Authentication |
Monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. Analytic 1 - Multiple failed logon attempts across different accounts.
|