Brute Force

What is Brute Force?

“Brute Force is documented as technique T1110 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Brute Force activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor authentication logs for accounts exceeding failed login thresholds within defined time windows, applying both per-account and per-source-IP analysis to detect both targeted and distributed brute force patterns.

2. 2

   Detect password spraying by analyzing authentication failures across many accounts from a single source or small set of sources, where each account has only a small number of failures that would not trigger individual account lockout policies.

3. 3

   Alert on credential stuffing patterns by monitoring for authentication attempts using usernames that match known breach data and originate from IP addresses associated with proxy services, botnets, or automated scanning infrastructure.

4. 4

   Track authentication failures against services not normally exposed to brute force attacks including internal applications, databases, and network devices, as attackers target these after gaining initial network access.

5. 5

   Monitor for offline password cracking indicators including large volumes of Kerberoastable service ticket requests, NTLM hash extraction attempts, and access to password database files on domain controllers.

Example Alerts

These realistic alert examples show what Brute Force looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Brute Force?

Detection centers on SIEM, Firewall telemetry for the credential access phase of the attack. Monitor authentication logs for accounts exceeding failed login thresholds within defined time windows, applying both per-account and per-source-IP analysis to detect both targeted and distributed brute force patterns. Detect password spraying by analyzing authentication failures across many accounts from a single source or small set of sources, where each account has only a small number of failures that would not trigger individual account lockout policies.

What does a Brute Force alert look like?

A representative SIEM detection is "Password Spraying Attack Against Active Directory" (high severity): Authentication analysis detected password spraying pattern: single password "Winter2024!" attempted against 847 Active Directory accounts over 23 minutes from IP 10.45.12.200. Attempting the same password across many accounts avoids per-account lockout thresholds. Three accounts successfully authenticated, indicating they used this predictable password.

Which tools detect Brute Force, and how can I practice?

Brute Force (T1110) is best surfaced with SIEM, Firewall telemetry, which exposes the credential access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.