Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

ID: T1110
Sub-techniques:  T1110.001, T1110.002, T1110.003, T1110.004
Tactic: Credential Access
Platforms: AWS, Azure, Azure AD, GCP, Linux, Office 365, SaaS, Windows, macOS
Permissions Required: User
Data Sources: Authentication logs, Office 365 account logs
CAPEC ID: CAPEC-49
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 2.1
Created: 31 May 2017
Last Modified: 21 October 2020

Procedure Examples

Name Description
APT39

APT39 has used Ncrack to reveal credentials.[1]

Chaos

Chaos conducts brute force attacks against SSH services to gain initial access.[2]

CrackMapExec

CrackMapExec can brute force supplied user credentials across a network range.[3]

DarkVishnya

DarkVishnya used brute-force attack to obtain login data.[4]

FIN5

FIN5 has has used the tool GET5 Penetrator to look for remote login and hard-coded credentials.[5][6]

OilRig

OilRig has used brute force techniques to obtain credentials.[7]

PoshC2

PoshC2 has modules for brute forcing local administrator and AD user accounts.[8]

Turla

Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.[9]

Mitigations

Mitigation Description
Account Use Policies

Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out.

Multi-factor Authentication

Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.

Password Policies

Refer to NIST guidelines when creating password policies.[10]

User Account Management

Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

Detection

Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

References