T1110Credential Access
Brute Force
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity…
CVEs14
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
25 Sigma rules tagged T1110Brute ForceT111025 general rules
- External Remote SMB Logon from Public IPhightest
- Hack Tool User Agenthightest
- HackTool - CrackMapExec Executionhightest
- HackTool - Hydra Password Bruteforce Executionhightest
- Password Spray Activityhightest
- Potential MFA Bypass Using Legacy Client Authenticationhightest
- Sign-in Failure Due to Conditional Access Requirements Not Methightest
- Use of Legacy Authentication Protocolshightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Brute Force
14 CVEs, by priority. Each link shows its badge.- CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 3 reportsMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.03%86.9priority
- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reportsMITRE CTID mapping of the KEV entry · how it is exploited99.4%Top 0.06%86.8priority
- CVE-2019-16782Possible Information Leak / Session Hijack Vulnerability in RackMITRE CTID mapping of the CVE · how it is exploited3.7%Top 10%22.4priority
- CVE-2020-15093Improper verification of signature threshold in toughMITRE CTID mapping of the CVE · how it is exploited1.4%Top 28%20.3priority
- CVE-2018-15795CredHub Service Broker uses guessable client secretMITRE CTID mapping of the CVE · how it is exploited1.3%Top 30%19.8priority
- CVE-2019-1715Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) SoftwareMedium · 5.3T1078Valid AccountsT1110Brute Force+2 moreMITRE CTID mapping of the CVE · how it is exploited1.7%Top 22%19.2priority
- CVE-2018-8160An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information…MITRE CTID mapping of the CVE · follow-on activity8.5%Top 5%19.0priority
- CVE-2018-11069RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also…MITRE CTID mapping of the CVE · how it is exploited1.3%Top 30%18.1priority
- CVE-2018-15800Timing attack allows extraction of signing key in Bits ServiceMITRE CTID mapping of the CVE · how it is exploited0.9%Top 40%17.8priority
- CVE-2020-11035weak CSRF tokens in GLPIMITRE CTID mapping of the CVE · how it is exploited0.9%Top 40%17.2priority
- CVE-2020-5365Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerabilityMITRE CTID mapping of the CVE · how it is exploited1.0%Top 38%16.2priority
- CVE-2019-6563Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the…MITRE CTID mapping of the CVE · how it is exploited1.7%Top 22%15.6priority
- CVE-2018-11045Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a…MITRE CTID mapping of the CVE · how it is exploited0.9%Top 42%11.7priority
- CVE-2019-18263An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with…MITRE CTID mapping of the CVE · how it is exploited0.2%Top 91%1.8priority
Passages that support these links
Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.