TA0006 · CREDENTIAL ACCESS
Brute Force
Password spraying, credential stuffing, and password guessing against exposed authentication surfaces.
Detect it with
Event ID 4625 across many accounts from one source (spray) or many sources for one account; cloud sign-in failure spikes.
Why it matters on shift
Brute Force is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1110.001
Password Guessing
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
- T1110.002
Password Cracking
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
- T1110.003
Password Spraying
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g.
- T1110.004
Credential Stuffing
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.
Kill-chain context