Technique on mitre.org

T1110: Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

netflow: PT-CR-2921: Netflow_Potential_Bruteforce: Multiple attempts to connect via TCP to various services on the same host (FTP, SSH, Telnet, SMTP, HTTP, POP3, IMAP, HTTPS, SMB, SMTPS, SMTP Alternate, IMAPS, POP3S, SQL Server, Oracle, SMTP Alternate, MySQL, RDP, PostgreSQL, VNC, HTTP Alternate, and HTTPS Alternate). This may indicate a brute-force attack. bruteforce: PT-CR-1774: Reason_Account_Blocked: A user account was locked

Subtechniques

Detection

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments that may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

ID	DS0002	Data source and component	User Account: User Account Authentication	Description	Monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

ID	DS0015	Data source and component	Application Log: Application Log Content	Description	Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

ID	Data source and component	Description
DS0017	Command: Command Execution	Monitor executed commands and arguments that may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
DS0002	User Account: User Account Authentication	Monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.
DS0015	Application Log: Application Log Content	Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

Mitigation

ID	M1018	Name	User Account Management	Description	Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

ID	M1027	Name	Password Policies	Description	Refer to NIST guidelines when creating password policies.

ID	M1032	Name	Multi-factor Authentication	Description	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.

ID	M1036	Name	Account Use Policies	Description	Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.

ID	Name	Description
M1018	User Account Management	Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.
M1027	Password Policies	Refer to NIST guidelines when creating password policies.
M1032	Multi-factor Authentication	Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
M1036	Account Use Policies	Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.