CyberStack

MITRE ATT&CK / Techniques / T1110

Brute Force

ID
T1110
Tactics
TA0006 Credential Access
Platforms
Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
Data sources
User Account Authentication
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.[4] Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.[5] Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.[6]

Sub-techniques (4)

Detection

Mitigations (4)

M1018 User Account Management

Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

M1027 Password Policies

Refer to NIST guidelines when creating password policies.[1]

M1032 Multi-factor Authentication

Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.

M1036 Account Use Policies

Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[2] Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.[3]

Groups (16)

Software (7)

References

  1. NIST 800-63-3
  2. Microsoft Common Conditional Access Policies
  3. Okta Block Anonymizing Services
  4. TrendMicro Pawn Storm Dec 2020
  5. Dragos Crashoverride 2018
  6. ReliaQuest Health Care Social Engineering Campaign 2024