Salt TyphoonG1045 ↗
Has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.1
- Tactic
- Credential Access
- Platforms
- Identity Provider, Linux, macOS, Network Devices, Office Suite, Windows
- Version
- 1.4
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributor
- Mohamed Kmal
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Password Cracking MITRE reference T1110.002
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
FIN6G0037 ↗
Has extracted password hashes from ntds.dit to crack offline.1
DragonflyG0035 ↗
Has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.12
APT3G0022 ↗
Has been known to brute force password hashes to be able to leverage plain text credentials.1
All 4 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries attempted to crack user passwords.1
Night DragonC0002 ↗
During Night Dragon, threat actors used Cain & Abel to crack password hashes.1
All 2 campaigns for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Net CrawlerS0056 ↗
Uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.1
All 1 software entries for this technique
Offense vs defense T1110.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2021 Q4 · 1 of 2 campaigns plotted (Night Dragon (dated 2009) falls before the 2018 window)Password Cracking detection strategy DET0105
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools
5 platforms
AN0292 · Windows
Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| HashToolName | Match execution against known cracking toolnames like hashcat.exe, john.exe, etc. |
| FilePathIndicators | Watch for access to common hash dump locations (e.g., SAM, SYSTEM, NTDS.dit) |
| ExecutionContext | Run context: local interactive user vs. scheduled task or remote session |
AN0293 · Linux
Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | linux:syslog | auth.log or custom tool logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ShadowAccessPattern | Access to /etc/shadow or known dumped hash files |
| CrackingBinaryPath | Tool path or name associated with hash cracking |
| CPUUsageThreshold | Sustained CPU load post-credential dump can be an indicator |
AN0294 · macOS
Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process and file events via log stream |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UnsignedBinaryPath | Path to untrusted binaries launched by user |
| UserPrivilegeLevel | Helps distinguish between system and user-launched activity |
AN0295 · Identity Provider
Sudden valid logins from accounts that previously had credentials dumped but had not authenticated successfully in the past; correlated with timeline of suspected hash cracking
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | Success logs from high-risk accounts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PostDumpTimeWindow | Detection window after credential dumping to watch for successful logins |
| LoginLocationRisk | Use IP/geolocation risk scoring to flag unusual access |
AN0296 · Network Devices
Offline cracking inferred by subsequent successful CLI or web-based authentications into routers or switches from previously dumped accounts
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | config access, authentication logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LogonTimeCorrelation | Window to link credential theft and reuse |
| SourceDeviceTag | Filters based on where cracking may have occurred externally |
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
Password PoliciesM1027
Refer to NIST guidelines when creating password policies.
Tests1Executorscmd 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition