T1110 Brute Force Mappings

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-02 Account Management Protects T1110 Brute Force
AC-20 Use of External Systems Protects T1110 Brute Force
AC-03 Access Enforcement Protects T1110 Brute Force
AC-05 Separation of Duties Protects T1110 Brute Force
AC-06 Least Privilege Protects T1110 Brute Force
AC-07 Unsuccessful Logon Attempts Protects T1110 Brute Force
CA-07 Continuous Monitoring Protects T1110 Brute Force
CM-02 Baseline Configuration Protects T1110 Brute Force
CM-06 Configuration Settings Protects T1110 Brute Force
IA-11 Re-authentication Protects T1110 Brute Force
IA-02 Identification and Authentication (organizational Users) Protects T1110 Brute Force
IA-04 Identifier Management Protects T1110 Brute Force
IA-05 Authenticator Management Protects T1110 Brute Force
SI-04 System Monitoring Protects T1110 Brute Force
ME-PWA-E3 Passwordless Authentication Technique Scores T1110 Brute Force
ME-PWP-E3 Password Policy Technique Scores T1110 Brute Force
ME-PP-E3 Password Protection Technique Scores T1110 Brute Force
ME-MFA-E3 Multi-factor Authentication Technique Scores T1110 Brute Force
ME-IP-E5 Identity Protection Technique Scores T1110 Brute Force
ME-CAE-E3 Conditional Access Evaluation Technique Scores T1110 Brute Force
ME-CA-E5 Conditional Access Technique Scores T1110 Brute Force
DEF-SecScore-E3 Secure Score Technique Scores T1110 Brute Force
DEF-SECA-E3 Security Alerts Technique Scores T1110 Brute Force
DEF-LM-E5 Lateral Movements Technique Scores T1110 Brute Force
DEF-IR-E5 Incident Response Technique Scores T1110 Brute Force
DO365-AG-E5 App Governance Technique Scores T1110 Brute Force
DO365-ATH-E5 Advanced Threat Hunting Technique Scores T1110 Brute Force

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1110.001 Password Guessing 25
T1110.002 Password Cracking 24
T1110.003 Password Spraying 26
T1110.004 Credential Stuffing 25