Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

ID: T1110
Sub-techniques:  T1110.001, T1110.002, T1110.003, T1110.004
Platforms: Azure AD, Containers, Google Workspace, IaaS, Linux, Network, Office 365, SaaS, Windows, macOS
CAPEC ID: CAPEC-49
Contributors: Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Ed Williams, Trustwave, SpiderLabs; Magno Logan, @magnologan, Trend Micro; Mohamed Kmal; Yossi Weizman, Azure Defender Research Team
Version: 2.4
Created: 31 May 2017
Last Modified: 19 April 2022

Procedure Examples

ID Name Description
G0007 APT28

APT28 can perform brute force attacks to obtain credentials.[1][2][3]

G0082 APT38

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[4]

G0087 APT39

APT39 has used Ncrack to reveal credentials.[5]

S0572 Caterpillar WebShell

Caterpillar WebShell has a module to perform brute force attacks on a system.[6]

S0220 Chaos

Chaos conducts brute force attacks against SSH services to gain initial access.[7]

S0488 CrackMapExec

CrackMapExec can brute force supplied user credentials across a network range.[8]

G0105 DarkVishnya

DarkVishnya used brute-force attack to obtain login data.[9]

G0035 Dragonfly

Dragonfly has attempted to brute force credentials to gain access.[10]

G0053 FIN5

FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.[11][12]

G0117 Fox Kitten

Fox Kitten has brute forced RDP credentials.[13]

S0599 Kinsing

Kinsing has attempted to brute force hosts over SSH.[14]

G0032 Lazarus Group

Lazarus Group has performed brute force attacks against administrator accounts.[15]

G0049 OilRig

OilRig has used brute force techniques to obtain credentials.[16]

S0378 PoshC2

PoshC2 has modules for brute forcing local administrator and AD user accounts.[17]

S0583 Pysa

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[18]

S0650 QakBot

QakBot can conduct brute force attacks to capture credentials.[19][20][21]

G0010 Turla

Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.[22]

Mitigations

ID Mitigation Description
M1036 Account Use Policies

Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out.

M1032 Multi-factor Authentication

Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.

M1027 Password Policies

Refer to NIST guidelines when creating password policies.[23]

M1018 User Account Management

Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

Detection

ID Data Source Data Component
DS0015 Application Log Application Log Content
DS0017 Command Command Execution
DS0002 User Account User Account Authentication

Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

References

  1. Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.
  2. Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm’s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.
  3. Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.
  4. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  5. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
  6. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  7. Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
  8. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
  9. Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.
  10. CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.
  11. Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.
  12. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.