Brute Force
Sub-techniques (4)
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Procedure Examples
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 |
APT28 can perform brute force attacks to obtain credentials.[1][2][3] |
| G0087 | APT39 | |
| S0572 | Caterpillar WebShell |
Caterpillar WebShell has a module to perform brute force attacks on a system.[5] |
| S0220 | Chaos |
Chaos conducts brute force attacks against SSH services to gain initial access.[6] |
| S0488 | CrackMapExec |
CrackMapExec can brute force supplied user credentials across a network range.[7] |
| G0105 | DarkVishnya |
DarkVishnya used brute-force attack to obtain login data.[8] |
| G0053 | FIN5 |
FIN5 has has used the tool GET5 Penetrator to look for remote login and hard-coded credentials.[9][10] |
| G0117 | Fox Kitten |
Fox Kitten has brute forced RDP credentials.[11] |
| S0599 | Kinsing | |
| G0049 | OilRig |
OilRig has used brute force techniques to obtain credentials.[13] |
| S0378 | PoshC2 |
PoshC2 has modules for brute forcing local administrator and AD user accounts.[14] |
| S0583 | Pysa |
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[15] |
| G0010 | Turla |
Turla may attempt to connect to systems within a victim's network using |
Mitigations
| ID | Mitigation | Description |
|---|---|---|
| M1036 | Account Use Policies |
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services. |
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies.[17] |
| M1018 | User Account Management |
Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts. |
Detection
Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.
References
- Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.
- Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm’s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.
- Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.
- Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
- ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
- Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.
- byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
- Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.
- Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.
- Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
- ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
- Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
- Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.
- Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
- CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.
- Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
- Grassi, P., et al. (2017, December 1). SP 800-63-3, Digital Identity Guidelines. Retrieved January 16, 2019.