Brute force
noun · also Brute-force attack, Password guessing · MITRE ATT&CK T1110
Gaining access by systematically trying passwords or keys until one works, either online against a login or offline against stolen hashes.
Brute force is the most direct way to defeat a password: keep guessing. MITRE ATT&CK groups four variations under it: password guessing against a live login (T1110.001), password cracking of stolen hashes offline (T1110.002), password spraying (T1110.003) and credential stuffing (T1110.004).
Online guessing is slow and noisy, and account lockout policies stop it quickly. Offline cracking is different: once an attacker has a copy of password hashes, they can test billions of guesses per second on their own hardware, with no logs and no lockout. That is why weak and reused passwords remain dangerous even behind a good lockout policy.
Example
An internet-facing Remote Desktop server receives tens of thousands of login attempts a day for the Administrator account from rotating IP addresses. Windows records each failure as event ID 4625. If the account has a weak password and no lockout, the attack eventually succeeds and event 4624 appears from the same source.
Why it matters for a SOC analyst
Brute force against exposed services such as RDP, VPNs and SSH is constant background noise, so the question is never "is someone guessing?" but "did any attempt succeed, and is the service exposed when it should not be?". Look for a success after a burst of failures, and treat exposed management interfaces without MFA as findings to fix, not just alerts to close.
Related terms
- Password spray
An attack that tries a few common passwords against many accounts, staying under lockout limits that per-account guessing would trigger.
- Credential stuffing
Automated sign-in attempts using username and password pairs leaked from other breaches, betting that people reuse the same password.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.