{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1110","id":"T1110","name":"Brute Force","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1110","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d35b377a293999a2b37a5876212512f0e17530a520a6308ccbc052c44d21b743","description":"Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. \n\nIf an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1110","external_id":"T1110"},{"source_name":"TrendMicro Pawn Storm Dec 2020","description":"Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm’s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source_name":"ReliaQuest Health Care Social Engineering Campaign 2024","description":"Hayden Evans. (2024, April 4). Health Care Social Engineering Campaign. Retrieved May 22, 2025.","url":"https://www.reliaquest.com/blog/health-care-social-engineering-campaign/"},{"source_name":"Dragos Crashoverride 2018","description":"Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1110.001","id":"T1110.001","name":"Password Guessing","page":"techniques/enterprise/T1110.001/"},{"key":"enterprise/T1110.002","id":"T1110.002","name":"Password Cracking","page":"techniques/enterprise/T1110.002/"},{"key":"enterprise/T1110.003","id":"T1110.003","name":"Password Spraying","page":"techniques/enterprise/T1110.003/"},{"key":"enterprise/T1110.004","id":"T1110.004","name":"Credential Stuffing","page":"techniques/enterprise/T1110.004/"}],"telemetry":[{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1110","technique_page":"techniques/enterprise/T1110/","page":"detections/enterprise/T1110/","status":"rule_source_available","counts":{"sigma":25,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"70ed1d26-0050-4b38-a599-92c53d57d45a","title":"Bitbucket User Login Failure","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/70ed1d26-0050-4b38-a599-92c53d57d45a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"d3f90469-fb05-42ce-b67d-0fded91bbef3","title":"Bitbucket User Login Failure Via SSH","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/d3f90469-fb05-42ce-b67d-0fded91bbef3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"6393e346-1977-46ef-8987-ad414a145fad","title":"AWS ConsoleLogin Failed Authentication","status":"experimental","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/6393e346-1977-46ef-8987-ad414a145fad.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml","author":"Ivan Saakov, Nasreddine Bencherchali","kind":"sigma"},{"id":"28ecba0a-c743-4690-ad29-9a8f6f25a6f9","title":"Password Spray Activity","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/28ecba0a-c743-4690-ad29-9a8f6f25a6f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a","title":"Account Lockout","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_account_lockout.yml","author":"AlertIQ","kind":"sigma"},{"id":"8c944ecb-6970-4541-8496-be554b8e2846","title":"Successful Authentications From Countries You Do Not Operate Out Of","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/8c944ecb-6970-4541-8496-be554b8e2846.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml","author":"MikeDuddington, '@dudders1'","kind":"sigma"},{"id":"28870ae4-6a13-4616-bd1a-235a7fad7458","title":"Failed Authentications From Countries You Do Not Operate Out Of","status":"test","level":"low","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/28870ae4-6a13-4616-bd1a-235a7fad7458.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml","author":"MikeDuddington, '@dudders1'","kind":"sigma"},{"id":"53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc","title":"Potential MFA Bypass Using Legacy Client Authentication","status":"test","level":"high","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml","author":"Harjot Singh, '@cyb3rjy0t'","kind":"sigma"},{"id":"b4a6d707-9430-4f5f-af68-0337f52d5c42","title":"Sign-in Failure Due to Conditional Access Requirements Not Met","status":"test","level":"high","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/b4a6d707-9430-4f5f-af68-0337f52d5c42.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml","author":"Yochana Henderson, '@Yochana-H'","kind":"sigma"},{"id":"60f6535a-760f-42a9-be3f-c9a0a025906e","title":"Use of Legacy Authentication Protocols","status":"test","level":"high","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/60f6535a-760f-42a9-be3f-c9a0a025906e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml","author":"Yochana Henderson, '@Yochana-H'","kind":"sigma"},{"id":"e40f4962-b02b-4192-9bfe-245f7ece1f99","title":"Multifactor Authentication Denied","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/e40f4962-b02b-4192-9bfe-245f7ece1f99.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_mfa_denies.yml","author":"AlertIQ","kind":"sigma"},{"id":"5496ff55-42ec-4369-81cb-00f417029e25","title":"Multifactor Authentication Interrupted","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/5496ff55-42ec-4369-81cb-00f417029e25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml","author":"AlertIQ","kind":"sigma"},{"id":"9a60e676-26ac-44c3-814b-0c2a8b977adf","title":"User Access Blocked by Azure Conditional Access","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/9a60e676-26ac-44c3-814b-0c2a8b977adf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml","author":"AlertIQ","kind":"sigma"},{"id":"56fa3cd6-f8d6-4520-a8c7-607292971886","title":"Cisco BGP Authentication Failures","status":"test","level":"low","logsource":{"product":"cisco","service":"bgp","definition":"Requirements: cisco bgp logs need to be enabled and ingested"},"data_path":"data/detection-rules/56fa3cd6-f8d6-4520-a8c7-607292971886.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml","author":"Tim Brown","kind":"sigma"},{"id":"50e606bf-04ce-4ca7-9d54-3449494bbd4b","title":"Cisco LDP Authentication Failures","status":"test","level":"low","logsource":{"product":"cisco","service":"ldp","definition":"Requirements: cisco ldp logs need to be enabled and ingested"},"data_path":"data/detection-rules/50e606bf-04ce-4ca7-9d54-3449494bbd4b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml","author":"Tim Brown","kind":"sigma"},{"id":"a557ffe6-ac54-43d2-ae69-158027082350","title":"Huawei BGP Authentication Failures","status":"test","level":"low","logsource":{"product":"huawei","service":"bgp","definition":"Requirements: huawei bgp logs need to be enabled and ingested"},"data_path":"data/detection-rules/a557ffe6-ac54-43d2-ae69-158027082350.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml","author":"Tim Brown","kind":"sigma"},{"id":"a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43","title":"Juniper BGP Missing MD5","status":"test","level":"low","logsource":{"product":"juniper","service":"bgp","definition":"Requirements: juniper bgp logs need to be enabled and ingested"},"data_path":"data/detection-rules/a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/juniper/bgp/juniper_bgp_missing_md5.yml","author":"Tim Brown","kind":"sigma"},{"id":"c42a3073-30fb-48ae-8c99-c23ada84b103","title":"Hack Tool User Agent","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/c42a3073-30fb-48ae-8c99-c23ada84b103.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_hacktool.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"218d2855-2bba-4f61-9c85-81d0ea63ac71","title":"MSSQL Server Failed Logon","status":"test","level":"low","logsource":{"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."},"data_path":"data/detection-rules/218d2855-2bba-4f61-9c85-81d0ea63ac71.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml","author":"Nasreddine Bencherchali (Nextron Systems), j4son","kind":"sigma"},{"id":"ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d","title":"MSSQL Server Failed Logon From External Network","status":"test","level":"medium","logsource":{"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."},"data_path":"data/detection-rules/ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml","author":"j4son","kind":"sigma"},{"id":"9c8acf1a-cbf9-4db6-b63c-74baabe03e59","title":"NTLM Brute Force","status":"test","level":"medium","logsource":{"product":"windows","service":"ntlm","definition":"Requires events from Microsoft-Windows-NTLM/Operational"},"data_path":"data/detection-rules/9c8acf1a-cbf9-4db6-b63c-74baabe03e59.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml","author":"Jerry Shockley '@jsh0x'","kind":"sigma"},{"id":"259a9cdf-c4dd-4fa2-b243-2269e5ab18a2","title":"External Remote RDP Logon from Public IP","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/259a9cdf-c4dd-4fa2-b243-2269e5ab18a2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","kind":"sigma"},{"id":"78d5cab4-557e-454f-9fb9-a222bd0d5edc","title":"External Remote SMB Logon from Public IP","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/78d5cab4-557e-454f-9fb9-a222bd0d5edc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","kind":"sigma"},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42a993dd-bb3e-48c8-b372-4d6684c4106c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"aaafa146-074c-11eb-adc1-0242ac120002","title":"HackTool - Hydra Password Bruteforce Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/aaafa146-074c-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_hydra.yml","author":"Vasiliy Burov","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1110-1","technique_id":"T1110","title":"Repeated password guessing against an account — T1110 Brute Force","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#password-guessing","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":77,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L77","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"d0f279cb40c84d0904dd9c81ee57e7083d40109771b8bbb91f5c909c279cf66a","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"account and source.","expected_behavior":"low failure counts and stable success-to-failure ratio.","deviation":"burst, rate increase, or ratio shift.","anomaly_types":[{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}],"log_sources":[{"title":"Identity Provider Sign-In Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#39-identity-provider-sign-in-logs"},{"title":"Directory-Service Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#41-directory-service-authentication-logs"}],"context_references":[{"title":"Scattered Spider joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa23-320a-scattered-spider.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231116.pdf"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}],"strategies":[{"id":"DET0463","name":"Brute Force Authentication Failures with Multi-Platform Log Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0463","stix_id":"x-mitre-detection-strategy--1439efe8-4d10-4ce8-8727-458db69bae85","relationship_id":"relationship--5cf10b86-166a-4ff1-8b30-715bf232b540","description":"","analytics":[{"id":"AN1275","name":"Analytic 1275","guidance":"High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe","url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1275","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Adjustable window to correlate failed logons, e.g., 5-10 minutes"},{"field":"UserContext","description":"Define scope of monitored users (e.g., service accounts, admins)"},{"field":"FailureThreshold","description":"Count of failed logons before raising an alert (e.g., 10-15)"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"WinEventLog:Security","channel":"EventCode=4776, 4625","platforms":["Windows"],"analytic_id":"AN1275","source_url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1275","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN1276","name":"Analytic 1276","guidance":"Multiple authentication failures for valid or invalid users followed by success from same IP/user","url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1276","platforms":["Linux"],"tuning":[{"field":"TimeWindow","description":"Period of brute force activity correlation (e.g., 5 mins)"},{"field":"IPWhitelist","description":"Exclude known monitoring IPs or jump boxes"},{"field":"LoginSource","description":"Filter SSH vs. local logins"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"auditd:USER_LOGIN","channel":"USER_AUTH","platforms":["Linux"],"analytic_id":"AN1276","source_url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1276","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN1277","name":"Analytic 1277","guidance":"Password spraying or brute force attempts across user pool within short time intervals","url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1277","platforms":["Identity Provider"],"tuning":[{"field":"UsernameSprayThreshold","description":"Max number of accounts targeted from a single IP"},{"field":"GeoAnomaly","description":"Mismatch between user location and request location"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"Sign-in logs","platforms":["Identity Provider"],"analytic_id":"AN1277","source_url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1277","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN1278","name":"Analytic 1278","guidance":"Multiple failed authentications in unified logs (e.g., loginwindow or sshd)","url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1278","platforms":["macOS"],"tuning":[{"field":"TimeWindow","description":"Scope of authentication failures (e.g., 10-15 mins)"},{"field":"TargetUser","description":"Filter known service or decoy accounts"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"macos:unifiedlog","channel":"auth","platforms":["macOS"],"analytic_id":"AN1278","source_url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1278","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN1279","name":"Analytic 1279","guidance":"Excessive login attempts followed by success from SaaS apps like O365, Dropbox, etc.","url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1279","platforms":["SaaS"],"tuning":[{"field":"AppName","description":"Detect brute force attempts targeting specific apps"},{"field":"UserGroup","description":"Limit alert scope to high-value user groups"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"m365:unified","channel":"Sign-in logs","platforms":["SaaS"],"analytic_id":"AN1279","source_url":"https://attack.mitre.org/detectionstrategies/DET0463#AN1279","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]}]}],"telemetry_references":[{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0220","name":"Chaos","url":"https://attack.mitre.org/software/S0220","kind":"malware","description":"[Chaos](https://attack.mitre.org/software/S0220) conducts brute force attacks against SSH services to gain initial access.(Citation: Chaos Stolen Backdoor)","relationship_id":"relationship--49c17cdc-72a5-442d-b153-2cc9f9cf059d","references":[{"source_name":"Chaos Stolen Backdoor","description":"Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.","url":"http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) has modules for brute forcing local administrator and AD user accounts.(Citation: GitHub PoshC2)","relationship_id":"relationship--8303719d-b2ed-4860-9af4-57b636c4f865","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can brute force supplied user credentials across a network range.(Citation: CME Github September 2018)","relationship_id":"relationship--fb0a3153-dbd8-4f32-8583-6a7e2fade337","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a module to perform brute force attacks on a system.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--4cf22fd0-af3a-41b7-b0ad-07b73b6d5516","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) has used brute force attempts against a central management console, as well as some Active Directory accounts.(Citation: CERT-FR PYSA April 2020)","relationship_id":"relationship--e9c00323-e4de-41ac-9051-55860ecfa8a0","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) has attempted to brute force hosts over SSH.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--6c56201e-f348-43ea-8b51-8230d2bf0970","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can conduct brute force attacks to capture credentials.(Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--91fd8374-eeba-4243-a8de-ff7353236024","references":[{"source_name":"Kroll Qakbot June 2020","description":"Sette, N. et al. (2020, June 4). Qakbot Malware Now Exfiltrating Emails for Sophisticated Thread Hijacking Attacks. Retrieved September 27, 2021.","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Crowdstrike Qakbot October 2020","description":"CS. (2020, October 7). Duck Hunting with Falcon Complete: A Fowl Banking Trojan Evolves, Part 2. Retrieved September 27, 2021.","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) can perform brute force attacks to obtain credentials.(Citation: TrendMicro Pawn Storm 2019)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Microsoft Targeting Elections September 2020)","relationship_id":"relationship--fb719ee1-0be9-41c5-bb52-56c033091e99","references":[{"source_name":"TrendMicro Pawn Storm 2019","description":"Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.","url":"https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf"},{"source_name":"TrendMicro Pawn Storm Dec 2020","description":"Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm’s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source_name":"Microsoft Targeting Elections September 2020","description":"Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) may attempt to connect to systems within a victim's network using <code>net use</code> commands and a predefined list or collection of passwords.(Citation: Kaspersky Turla)","relationship_id":"relationship--5682d524-80f0-4fd8-9960-6f54eeafce96","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has attempted to brute force credentials to gain access.(Citation: CISA AA20-296A Berserk Bear December 2020)","relationship_id":"relationship--d9bdae16-d3b3-4260-b1ef-2624cf4e836c","references":[{"source_name":"CISA AA20-296A Berserk Bear December 2020","description":"CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used brute force techniques to obtain credentials.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: IBM ZeroCleare Wiper December 2019)","relationship_id":"relationship--7f7226d7-6980-402a-b10e-e81b50c7ee09","references":[{"source_name":"FireEye APT34 Webinar Dec 2017","description":"Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source_name":"IBM ZeroCleare Wiper December 2019","description":"Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.","url":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"}]},{"id":"G0053","name":"FIN5","url":"https://attack.mitre.org/groups/G0053","kind":"intrusion-set","description":"[FIN5](https://attack.mitre.org/groups/G0053) has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)","relationship_id":"relationship--6b429676-7b77-4453-a6ce-2d6a6cb0dfe7","references":[{"source_name":"DarkReading FireEye FIN5 Oct 2015","description":"Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.","url":"https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"},{"source_name":"Mandiant FIN5 GrrCON Oct 2016","description":"Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.(Citation: CISA AA20-239A BeagleBoyz August 2020)","relationship_id":"relationship--7efb7077-5119-4508-b467-f7da76cc6df6","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used Ncrack to reveal credentials.(Citation: FireEye APT39 Jan 2019)","relationship_id":"relationship--c4a566d6-69ce-4284-809d-433663e3e2fa","references":[{"source_name":"FireEye APT39 Jan 2019","description":"Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) performed password brute-force attacks on the local admin account.(Citation: FireEye APT41 Aug 2019)","relationship_id":"relationship--79958036-a8bf-4808-af4f-f9f7a9cb6e7c","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0105","name":"DarkVishnya","url":"https://attack.mitre.org/groups/G0105","kind":"intrusion-set","description":"[DarkVishnya](https://attack.mitre.org/groups/G0105) used brute-force attack to obtain login data.(Citation: Securelist DarkVishnya Dec 2018)","relationship_id":"relationship--5a9197b3-c5fb-4288-9fdf-684fa289435b","references":[{"source_name":"Securelist DarkVishnya Dec 2018","description":"Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.","url":"https://securelist.com/darkvishnya/89169/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has brute forced RDP credentials.(Citation: ClearSky Pay2Kitten December 2020)","relationship_id":"relationship--1b4baaaa-f08e-4f67-8d32-a7facb21eb7b","references":[{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"id":"G1001","name":"HEXANE","url":"https://attack.mitre.org/groups/G1001","kind":"intrusion-set","description":"[HEXANE](https://attack.mitre.org/groups/G1001) has used brute force attacks to compromise valid credentials.(Citation: SecureWorks August 2019)","relationship_id":"relationship--2cc576f4-9d7d-47e4-a6c5-a6910f8b5b62","references":[{"source_name":"SecureWorks August 2019","description":"SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) used the `su-bruteforce` tool to brute force specific users using the `su` command.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--54b880ab-5c20-4689-9fbc-a6beed8874a1","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) engaged in various brute forcing activities via SMB in victim environments.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--922dc509-f22e-4c69-aad6-098fedfb30f7","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has leveraged brute force attacks to obtain credentials.(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--fa9a28d1-3623-478b-a9db-8aa587ec44d1","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has conducted brute-force attempts against organizational VPN infrastructure.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--ee26ee12-a780-4c43-8a20-244b8f91794f","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has performed brute force attacks against edge devices, such as VPNs or firewall solutions.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)   ","relationship_id":"relationship--c728ccae-df91-4801-824d-2e235269eb8f","references":[{"source_name":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","description":"Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026.","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.","relationship_id":"relationship--b61fb6ca-82b8-4928-8f1b-7a48645bd888","references":[]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Refer to NIST guidelines when creating password policies.(Citation: NIST 800-63-3)","relationship_id":"relationship--d1f67e5c-72c6-4e26-91d4-bc8593e61774","references":[{"source_name":"NIST 800-63-3","description":"Temoshok, D., et al. (July 2025). SP 800-63-4, Digital Identity Guidelines. Retrieved July 29, 2026.","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-4.pdf"}]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.","relationship_id":"relationship--cb87a0ce-0976-49e5-8e9c-2c908a24b30f","references":[]},{"id":"M1036","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M1036","kind":"course-of-action","description":"Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.(Citation: Microsoft Common Conditional Access Policies) Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.(Citation: Okta Block Anonymizing Services)","relationship_id":"relationship--c1a6c86e-5d5d-4cf1-845e-1660d9c19baf","references":[{"source_name":"Microsoft Common Conditional Access Policies","description":"Microsoft. (2022, December 14). Conditional Access templates. Retrieved February 21, 2023.","url":"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common"},{"source_name":"Okta Block Anonymizing Services","description":"Moussa Diallo and Brett Winterford. (2024, April 26). How to Block Anonymizing Services using Okta. Retrieved May 28, 2024.","url":"https://sec.okta.com/blockanonymizers"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1003":"/ttp-simulation/techniques/enterprise/T1003/","T1087":"/ttp-simulation/techniques/enterprise/T1087/","T1201":"/ttp-simulation/techniques/enterprise/T1201/","T1133":"/ttp-simulation/techniques/enterprise/T1133/","T1110":"/ttp-simulation/techniques/enterprise/T1110/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1110","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}