T1110 Brute Force

Technique

T1110

Tactics

Credential Access

Research, 90 days

0

KEV CVEs mapped

2

SigmaHQ rules

25

Elastic, Splunk

72

thrunt rules

0

Active families

Mirai

Upstream

https://attack.mitre.org/techniques/T1110

MITRE description

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to log in to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2020-1472
• CVE-2020-0688

Detection coverage

SigmaHQ community rules

• Bitbucket User Login Failure (core)
• Bitbucket User Login Failure Via SSH (core)
• AWS ConsoleLogin Failed Authentication (core)
• Password Spray Activity (core)
• Account Lockout (core)
• Successful Authentications From Countries You Do Not Operate Out Of (core)
• Failed Authentications From Countries You Do Not Operate Out Of (core)
• Potential MFA Bypass Using Legacy Client Authentication (core)
• Sign-in Failure Due to Conditional Access Requirements Not Met (core)
• Use of Legacy Authentication Protocols (core)
• Multifactor Authentication Denied (core)
• Multifactor Authentication Interrupted (core)
• User Access Blocked by Azure Conditional Access (core)
• Cisco BGP Authentication Failures (core)
• Cisco LDP Authentication Failures (core)
• Huawei BGP Authentication Failures (core)
• Juniper BGP Missing MD5 (core)
• Hack Tool User Agent (core)
• MSSQL Server Failed Logon From External Network (core)
• MSSQL Server Failed Logon (core)
• NTLM Brute Force (core)
• External Remote RDP Logon from Public IP (core)
• External Remote SMB Logon from Public IP (core)
• HackTool - CrackMapExec Execution (core)
• HackTool - Hydra Password Bruteforce Execution (core)

Elastic and Splunk rules

• Web Server Suspicious User Agent Requests (elastic)
• Anthropic Multiple Authentication Failures (elastic)
• AWS Management Console Brute Force of Root User Identity (elastic)
• AWS Root Console Login Password Spraying (elastic)
• AWS IAM Principal Enumeration via UpdateAssumeRolePolicy (elastic)
• Entra ID User Sign-in Brute Force Attempted (elastic)
• Entra ID Excessive Account Lockouts Detected (elastic)
• Entra ID ROPC Authentication with Unknown Client ID (elastic)
• Entra ID Sign-in Brute Force Attempted (Microsoft 365) (elastic)
• Entra ID MFA TOTP Brute Force Attempted (elastic)
• Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
• Entra ID Protection - Risk Detection - Sign-in Risk (elastic)
• Entra ID Protection - Risk Detection - User Risk (elastic)
• Potential SSH Brute Force Detected via macOS Security Events (elastic)
• Potential Successful SSH Brute Force Attack via macOS Security Events (elastic)
• Excessive Sudo Authentication Failures via macOS Security Events (elastic)
• M365 Identity User Brute Force Attempted (elastic)
• M365 Identity User Account Lockouts (elastic)
• Attempts to Brute Force an Okta User Account (elastic)
• Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy (elastic)
• Multiple Okta User Authentication Events with Same Device Token Hash (elastic)
• Potential Okta Brute Force (Device Token Rotation) (elastic)
• Potential Okta Brute Force (Multi-Source) (elastic)
• Potential Okta Credential Stuffing (Single Source) (elastic)
• Potential Okta Password Spray (Multi-Source) (elastic)

Showing 25 of 72.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.