Brute Force
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every analytic in the brief defines brute force as a count over a time window followed by a join, and lib/sigma models neither. AN1275 (Windows, Security 4776 and 4625) is literally 'high volume of failed logon attempts followed by a successful one', and its two tuning knobs are FailureThreshold ('count of failed logons before raising an alert, e.g. 10-15') and TimeWindow ('e.g. 5-10 minutes') — the threshold and the correlation window are not tuning around the detection, they are the detection. Sigma as this corpus constrains it has no aggregation, no timeframe and no join to the subsequent success event, so the only rule expressible at the parent is 'a 4625 or 4776 failure occurred', which fires on every mistyped password, every stale saved credential in Credential Manager, every scheduled task and service still running an old password, and every reconnecting mapped drive in the estate […]
Covered instead by T1110.001, T1110.002, T1110.003, T1110.004.
What the technique is
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1275
High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe
- AN1276
Multiple authentication failures for valid or invalid users followed by success from same IP/user
- AN1277
Password spraying or brute force attempts across user pool within short time intervals
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.