[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1110":3},{"item":4,"lessons":18,"controls":69,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1110","T1110","Brute Force",9,"MITRE","**What attackers do.** Attackers try to get into accounts by guessing passwords, trying common passwords across many accounts, reusing leaked credentials, or cracking stolen password hashes. This serves the Credential Access tactic.\n\n**How to defend.** Enforce MFA, block common and breached passwords, and use smart account lockout that limits attackers without locking users out. Disable legacy authentication protocols that bypass MFA. Monitor identity provider, VPN and directory logs for failed logins across many accounts.\n\n**Signs to look for.** Look for many failed logins from one source, a few failures each across many accounts, successful logins after failures, and authentication against legacy protocols. A common gap is attackers spreading attempts slowly across sources to stay under thresholds. Password spraying against cloud services is common, so check sign-in logs for one source touching many accounts.","Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. \n\nIf an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1110\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},12,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","2026-11-13T15:20:23.452+00:00",{"slug":26,"title":27,"published_at":28},"weak-sql-server-credentials-open-door-to-miners-and-rat","Weak SQL Server Credentials Open Door to Miners and RAT","2026-11-12T17:21:13.877+00:00",{"slug":30,"title":31,"published_at":32},"brute-force-attacks-on-internet-facing-services-demand-active-detection-and-strong-authentication","Brute Force Attacks on Internet-Facing Services Demand Active Detection and Strong Authentication","2026-11-07T00:20:46.096+00:00",{"slug":34,"title":35,"published_at":36},"ssh-brute-force-attack-leads-to-multi-million-dollar-extortion-scheme","SSH Brute-Force Attack Leads to Multi-Million Dollar Extortion Scheme","2026-09-28T08:20:18.613+00:00",{"slug":38,"title":39,"published_at":40},"ai-powered-multi-agent-frameworks-accelerate-credential-theft-at-scale","AI-Powered Multi-Agent Frameworks Accelerate Credential Theft at Scale","2026-09-08T14:22:44.797+00:00",{"slug":42,"title":43,"published_at":44},"evooo1bot-botnet-turns-unpatched-linux-devices-into-multi-purpose-attack-infrastructure","Evooo1Bot Botnet Turns Unpatched Linux Devices Into Multi-Purpose Attack Infrastructure","2026-08-17T18:20:22.278+00:00",{"slug":46,"title":47,"published_at":48},"leaked-credentials-expose-fortune-500-azure-tenants-to-mass-data-theft","Leaked Credentials Expose Fortune 500 Azure Tenants to Mass Data Theft","2026-08-17T08:20:23.495+00:00",{"slug":50,"title":51,"published_at":52},"mirai-based-botnet-hijacks-routers-via-known-vulnerabilities","Mirai-Based Botnet Hijacks Routers via Known Vulnerabilities","2026-08-15T16:20:22.954+00:00",{"slug":54,"title":55,"published_at":56},"tengu-botnet-abuses-hardware-watchdogs-to-survive-defender-takedowns-on-linux-devices","Tengu Botnet Abuses Hardware Watchdogs to Survive Defender Takedowns on Linux Devices","2026-07-28T16:20:48.19+00:00",{"slug":58,"title":59,"published_at":60},"ai-tool-weaponized-to-manage-botnet-and-breach-dental-clinic-database","AI Tool Weaponized to Manage Botnet and Breach Dental Clinic Database","2026-07-15T20:20:54.065+00:00",{"slug":62,"title":63,"published_at":64},"llm-assisted-iot-botnet-targets-weak-telnet-credentials-and-unpatched-devices","LLM-Assisted IoT Botnet Targets Weak Telnet Credentials and Unpatched Devices","2026-07-15T20:20:39.296+00:00",{"slug":66,"title":67,"published_at":68},"oauth-spoofing-bypasses-entra-id-sign-in-telemetry-to-validate-stolen-credentials","OAuth Spoofing Bypasses Entra ID Sign-In Telemetry to Validate Stolen Credentials","2026-07-14T14:22:31.331+00:00",[70,74,79,84,88,93],{"slug":71,"name":72,"problem":73,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":75,"name":76,"problem":77,"stories":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,{"slug":80,"name":81,"problem":82,"stories":83},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",4,{"slug":85,"name":86,"problem":87,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":89,"name":90,"problem":91,"stories":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",3,{"slug":94,"name":95,"problem":96,"stories":92},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[98,104,109,113,118,123,127,131],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","ia-5","IA-5","Authenticator Management",8,{"family":105,"item":106,"code":107,"title":108,"together":103},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":105,"item":110,"code":111,"title":112,"together":78},"12","Control 12","Network Infrastructure Management",{"family":105,"item":114,"code":115,"title":116,"together":117},"6","Control 6","Access Control Management",6,{"family":99,"item":119,"code":120,"title":121,"together":122},"ac-17","AC-17","Remote Access",5,{"family":99,"item":124,"code":125,"title":126,"together":122},"ac-2","AC-2","Account Management",{"family":5,"item":128,"code":129,"title":130,"together":83},"t1078","T1078","Valid Accounts",{"family":105,"item":132,"code":133,"title":134,"together":83},"8","Control 8","Audit Log Management"]