Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Brute Force Authentication Attempts

Brute Force Authentication Attempts

2 min read

Jump to:

Overview

Brute Force Authentication Attempts involve systematically trying numerous username and password combinations to gain unauthorized access to accounts or systems. This technique is commonly employed during the Initial Access and Persistence phases of an attack lifecycle, enabling adversaries to bypass authentication controls and establish footholds within target environments.

Attack Objective

Gain unauthorized access to user or administrative accounts
Supports Initial Access, Persistence, Privilege Escalation, and Lateral Movement stages
Advances attacker position by compromising credentials to access systems, escalate privileges, or maintain access

How the Technique Works

Adversaries automate repeated login attempts using lists of usernames and passwords, often leveraging credential dumps, default credentials, or commonly used passwords. By exploiting weak or reused credentials, attackers can bypass authentication mechanisms. The process may target local systems, network services, cloud identities, or applications, depending on the environment.

Common Methods & Variations

Online brute force via login portals, remote desktop protocols, or network services (e.g., SSH, SMB)
Offline brute force against hashed password databases or captured authentication tokens
Targeting on-premises infrastructure, cloud identity providers, endpoints, or network devices
Use of living-off-the-land tools such as built-in OS utilities or scripting frameworks versus custom brute force tools

Indicators of Compromise (IOCs)

Repeated failed login attempts from a single or multiple sources within short timeframes
Unusual authentication patterns, such as attempts outside normal hours or from unexpected geographic locations
Account lockouts or alerts triggered by authentication failures
Network traffic showing repeated authentication requests to services like RDP, SSH, or web login portals

Detection Strategies

Monitoring authentication logs from endpoints, identity providers, and network services
Behavioral detection focusing on anomalous login failure rates and patterns
Correlation of failed login attempts with source IP reputation and geolocation data
Use of threshold-based alerts for rapid successive authentication failures

Mitigation & Prevention

Enforce strong, unique passwords and implement multi-factor authentication (MFA)
Account lockout policies and throttling to limit repeated login attempts
Network segmentation and limiting access to authentication services
Regular credential hygiene, including password rotation and monitoring for credential exposure

Response Considerations

Immediately block or isolate source IP addresses exhibiting brute force activity
Investigate affected accounts for signs of compromise or unauthorized access
Reset passwords and enforce MFA for targeted accounts
Review logs to determine scope and timeline of the attack and implement additional hardening measures

Related Techniques

Credential Dumping – obtaining credentials to facilitate brute force or reuse
Valid Accounts – use of compromised credentials post-brute force
Account Manipulation – modifying account settings after gaining access
Lateral Movement – leveraging brute forced credentials to move within a network

Mapping & References

MITRE ATT&CK T1110: Brute Force
MITRE ATT&CK T1110.001: Password Guessing
Public research on brute force detection and prevention methodologies
Industry advisories on credential-based attacks and authentication security best practices

Tags: Authentication Brute Force Credential Attacks Cybersecurity Detection Incident Response Initial Access Mitigation MITRE ATT&CK persistence privilege escalation