Automation · API / MCP 中文

Technique note · T1110

Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to log in to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.

ATT&CK T1110 platforms — Status Active Version 20.1

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.1 Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.2 Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to log in to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.3

  1. TrendMicro Pawn Storm Dec 2020
  2. Dragos Crashoverride 2018
  3. ReliaQuest Health Care Social Engineering Campaign 2024

Groups using this technique

GroupNameCountry
grp_g0105DarkVishnya—
grp_g1030AgriusIran
grp_g0053FIN5—
grp_g0117Fox Kitten—
grp_g1001HEXANE—
grp_g1057ShinyHunters—
grp_g0035DragonflyRussia
grp_g0049OilRigIran
grp_g1053Storm-0501—
grp_g1055VOID MANTICORE—
grp_g0082APT38DPRK
grp_g0087APT39—
grp_g0010TurlaRussia
grp_g1003Ember BearRussia
grp_g0096APT41China
grp_g0007APT28Russia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.