Brute Force Attack

Attackers use brute force to gain access to accounts when passwords are unknown or when they have obtained password hashes. The guessing can run against a service that checks whether the credentials are valid, or offline against previously acquired credential data such as password hashes. MITRE ATT&CK lists brute force as technique T1110 under the credential access tactic, with four sub-techniques: password guessing, password cracking, password spraying, and credential stuffing.

In a dictionary attack, a type of brute force attack, the guesses come from lists of words, phrases, or commonly used passwords. Brute forcing can happen at various points during a breach, as part of initial access against external remote services or later against valid accounts inside a victim environment.

In logs, brute forcing shows up as a high volume of failed logon attempts, sometimes followed by a successful one, or as multiple authentication failures followed by success from the same IP address or user.

Defenses include account lockout after a set number of failed login attempts, multi-factor authentication on externally facing services, conditional access policies that block logins from non-compliant devices or from outside defined organization IP ranges, and password policies that follow NIST guidelines. A lockout policy that is too strict can create a denial of service condition, with every account used in the attack locked out.