Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| amazon_cognito | Amazon Cognito | technique_scores | T1110 | Brute Force |
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1110 | Brute Force |
| amazon_inspector | Amazon Inspector | technique_scores | T1110 | Brute Force |
| aws_config | AWS Config | technique_scores | T1110 | Brute Force |
| aws_identity_and_access_management | AWS Identity and Access Management | technique_scores | T1110 | Brute Force |
| aws_security_hub | AWS Security Hub | technique_scores | T1110 | Brute Force |
| aws_single_sign-on | AWS Single Sign-On | technique_scores | T1110 | Brute Force |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1110.001 | Password Guessing | 7 |
| T1110.002 | Password Cracking | 3 |
| T1110.003 | Password Spraying | 7 |
| T1110.004 | Credential Stuffing | 7 |