Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Specifically, adversaries may try to brute force password-based authentication for SSH External Remote Services and Remote Service or password-protected SSH keys.

Procedure Examples

Name Description
APT39

APT39 has used Ncrack to reveal credentials.[1]

Linux Rabbit

Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server. [1]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

References

Attachments

ID
VT0013
MITRE ID
Sub-techniques
No sub-techniques
Tactic
Credential Access
Platforms
AWS
Azure
Azure AD
GCP
Linux
Office 365
SaaS
Windows
macOS
Permissions Required
User
Data Sources
Authentication logs
Office 365 account logs
CAPEC ID
Version
2.1

Created: 21 December 2020

Last Modified: 13 April 2021