T1110 Brute Force Mappings

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
cloud_ids Cloud IDS technique_scores T1110 Brute Force
actifio_go Actifio Go technique_scores T1110 Brute Force
identityplatform IdentityPlatform technique_scores T1110 Brute Force
cloud_identity Cloud Identity technique_scores T1110 Brute Force
endpoint_management Endpoint Management technique_scores T1110 Brute Force
security_command_center Security Command Center technique_scores T1110 Brute Force
advancedprotectionprogram AdvancedProtectionProgram technique_scores T1110 Brute Force

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1110.004 Credential Stuffing 3
T1110.002 Password Cracking 3
T1110.001 Password Guessing 3
T1110.003 Password Spraying 3