Repeated password guessing against an account — T1110 Brute Force
Comparison unit: account and source.
Expected behavior: low failure counts and stable success-to-failure ratio.
Deviation: burst, rate increase, or ratio shift.
Loading interactive filters…
1200KM / detection
T1110 Brute Force — Detection Rules
Detection workspace for T1110 Brute Force: 25 Sigma sources, 0 Atlas concepts and 1 anomaly models. No live detection validation.
Source-backed rule directory
- Bitbucket User Login Failure · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
- Bitbucket User Login Failure Via SSH · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
- AWS ConsoleLogin Failed Authentication · experimental · medium · {"product":"aws","service":"cloudtrail"}
- Password Spray Activity · test · high · {"product":"azure","service":"riskdetection"}
- Account Lockout · test · medium · {"product":"azure","service":"signinlogs"}
- Successful Authentications From Countries You Do Not Operate Out Of · test · medium · {"product":"azure","service":"signinlogs"}
- Failed Authentications From Countries You Do Not Operate Out Of · test · low · {"product":"azure","service":"signinlogs"}
- Potential MFA Bypass Using Legacy Client Authentication · test · high · {"product":"azure","service":"signinlogs"}
- Sign-in Failure Due to Conditional Access Requirements Not Met · test · high · {"product":"azure","service":"signinlogs"}
- Use of Legacy Authentication Protocols · test · high · {"product":"azure","service":"signinlogs"}
- Multifactor Authentication Denied · test · medium · {"product":"azure","service":"signinlogs"}
- Multifactor Authentication Interrupted · test · medium · {"product":"azure","service":"signinlogs"}
- User Access Blocked by Azure Conditional Access · test · medium · {"product":"azure","service":"signinlogs"}
- Cisco BGP Authentication Failures · test · low · {"product":"cisco","service":"bgp","definition":"Requirements: cisco bgp logs need to be enabled and ingested"}
- Cisco LDP Authentication Failures · test · low · {"product":"cisco","service":"ldp","definition":"Requirements: cisco ldp logs need to be enabled and ingested"}
- Huawei BGP Authentication Failures · test · low · {"product":"huawei","service":"bgp","definition":"Requirements: huawei bgp logs need to be enabled and ingested"}
- Juniper BGP Missing MD5 · test · low · {"product":"juniper","service":"bgp","definition":"Requirements: juniper bgp logs need to be enabled and ingested"}
- Hack Tool User Agent · test · high · {"category":"proxy"}
- MSSQL Server Failed Logon · test · low · {"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."}
- MSSQL Server Failed Logon From External Network · test · medium · {"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."}
- NTLM Brute Force · test · medium · {"product":"windows","service":"ntlm","definition":"Requires events from Microsoft-Windows-NTLM/Operational"}
- External Remote RDP Logon from Public IP · test · medium · {"product":"windows","service":"security"}
- External Remote SMB Logon from Public IP · test · high · {"product":"windows","service":"security"}
- HackTool - CrackMapExec Execution · test · high · {"category":"process_creation","product":"windows"}
- HackTool - Hydra Password Bruteforce Execution · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
ATT&CK analytic guidance
DET0463 Brute Force Authentication Failures with Multi-Platform Log Correlation
AN1275 Analytic 1275
High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe
AN1276 Analytic 1276
Multiple authentication failures for valid or invalid users followed by success from same IP/user
AN1277 Analytic 1277
Password spraying or brute force attempts across user pool within short time intervals
AN1278 Analytic 1278
Multiple failed authentications in unified logs (e.g., loginwindow or sshd)
AN1279 Analytic 1279
Excessive login attempts followed by success from SaaS apps like O365, Dropbox, etc.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Connected anomaly research
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.