Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)
Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:
In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)
In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1110.003 | Password Spraying |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), strengthens cybersecurity defenses by enabling faster, real-time detection of brute force attacks. This integrated solution enhances CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
Brute force attacks involve adversaries attempting to gain unauthorized access to systems by systematically guessing passwords or encryption keys. These attacks often involve high volumes of login attempts or other forms of credential stuffing, exploiting weak or reused passwords. Intel TDT plays a key role in identifying these attacks by providing real-time telemetry on program execution, memory access, and control flow, enabling security teams to detect abnormal behaviors such as unusually high login attempts, suspicious API calls, or rapid access attempts that may indicate brute force activity.
Additionally, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, ensuring faster, more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as repeated login failures, dictionary attacks, or other signs of brute force methods used to bypass security defenses.
By leveraging Intel TDT and CAMS's combined capabilities, organizations can detect and stop brute force attacks more efficiently, strengthening their defenses against unauthorized access and reducing the risk of compromise from credential-based threats.
References
|
| intel-ptt | Intel Platform Trust Technology | Win 11, ESS/Hello | T1110.003 | Password Spraying |
Comments
Windows Hello ESS authentication leverages virtual sandbox(Intel VT-X) to protect authentication data to significantly reduce the risk of brute force attacks on passwords, as biometrics typically require physical presence or biometric data that cannot be easily guessed or replicated. It uses the TPM (Intel PTT) to store authentication data including public/private key pairs. Windows Hello also includes Passkeys, a passwordless authentication option that generates public/private key pair with the public key shared with the service requiring authentication and the private key stored in the TPM, which is only released after authentication locally on the device using either a biometric factor such as fingerprint, facial recognition, or a PIN. Windows Hello helps protect against the risk of credentials being stored in files by eliminating the need for passwords in many authentication scenarios.
Windows Hello utilizes passkeys which helps protect against the risk of credentials being stored in files by eliminating the need for passwords.
References
|