ATT&CK coverage › Technique

Brute Force: Password Guessing T1110.001

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Events covered

6 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon3Network connection
Security-Auditing4624An account was successfully logged on.
Security-Auditing4625An account failed to log on.
Security-Auditing4688A new process has been created.
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

Patterns shared across the 6 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (15 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType3eq 3logon-failed, logged-in
LogonType3eq 3Network
source.ip3is_not_null 2, ne 1127.0.0.1, ::1
user.domain2ne 2NT AUTHORITY
event.category2eq 2authentication
computer_name2is_not_null 2
Esql.failed_auth_count2ge 2100, 50
Esql.count_distinct_target_user_name1ge 12
Esql.count_distinct_user_name1ge 12
CommandLine1match 1^PASS^, ^USER^, -p
ScriptBlockText1match 1System.DirectoryServices.Protocols.LdapDirectoryIdentifier, System.DirectoryServices.Protocols.LdapConnection, System.Net.NetworkCredential
All_Traffic.app1eq 1rdp
duration1lt 13600
count1gt 110
DestinationPort1eq 13389

Top indicator values (22 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
EventTypeeqlogon-failed33
LogonTypeeqNetwork34
user.domainneNT AUTHORITY22
event.categoryeqauthentication25
EventTypeeqlogged-in17
source.ipne::117
source.ipne127.0.0.118
Esql.failed_auth_countge1001
Esql.count_distinct_target_user_namege21
Esql.count_distinct_user_namege21
Esql.failed_auth_countge501
CommandLinematch^USER^1
CommandLinematch-p 12
CommandLinematch-u 13
CommandLinematch^PASS^1
ScriptBlockTextmatchSystem.DirectoryServices.Protocols.LdapConnection1
ScriptBlockTextmatchSystem.DirectoryServices.Protocols.LdapDirectoryIdentifier1
ScriptBlockTextmatchSystem.Net.NetworkCredential1
countgt101
DestinationPorteq338913

Common exclusions (15 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
Statusin0xc00001332
Statusin0xc000005e2
Statusin0xc000015b2
Statusin0xc00000dc2
Statusin0xc00001922
userwildcard*$1
user.ideqS-1-0-01
userwildcardANONYMOUS LOGON1
Statuseq0xC000015B1
Statuseq0XC000005E1
Statuseq0XC00001921
userwildcard-1
Statuseq0XC00001331
TargetUserSideqS-1-0-01
userends_with$1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 2 rules

Elastic 3 rules

Splunk 1 rule