Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Brute Force

Sub-techniques (4)

ID	Name
.001	Password Guessing
.002	Password Cracking
.003	Password Spraying
.004	Credential Stuffing

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

ID: T1110

Sub-techniques: .001 .002 .003 .004

Tactic(s): Credential Access

Platforms: Containers, IaaS, Identity Provider, Linux, macOS, Network, Office Suite, SaaS, Windows

Data Sources: Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication

Version: 2.6

Created: 31 May 2017

Last Modified: 14 Oct 2024

Name	Description
Procedure Examples
Fox Kitten	Fox Kitten has brute forced RDP credentials.(Citation: ClearSky Pay2Kitten December 2020)
HEXANE	HEXANE has used brute force attacks to compromise valid credentials.(Citation: SecureWorks August 2019)
Chaos	Chaos conducts brute force attacks against SSH services to gain initial access.(Citation: Chaos Stolen Backdoor)
Caterpillar WebShell	Caterpillar WebShell has a module to perform brute force attacks on a system.(Citation: ClearSky Lebanese Cedar Jan 2021)
Ember Bear	Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.(Citation: CISA GRU29155 2024)
Turla	Turla may attempt to connect to systems within a victim's network using `net use` commands and a predefined list or collection of passwords.(Citation: Kaspersky Turla)
DarkVishnya	DarkVishnya used brute-force attack to obtain login data.(Citation: Securelist DarkVishnya Dec 2018)
	During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.(Citation: ESET Lazarus Jun 2020)
Lazarus Group	Lazarus Group has performed brute force attacks against administrator accounts.(Citation: ESET Lazarus Jun 2020)
FIN5	FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)
Kinsing	Kinsing has attempted to brute force hosts over SSH.(Citation: Aqua Kinsing April 2020)
APT41	APT41 performed password brute-force attacks on the local admin account.(Citation: FireEye APT41 Aug 2019)
APT38	APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.(Citation: CISA AA20-239A BeagleBoyz August 2020)
OilRig	OilRig has used brute force techniques to obtain credentials.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: IBM ZeroCleare Wiper December 2019)
PoshC2	PoshC2 has modules for brute forcing local administrator and AD user accounts.(Citation: GitHub PoshC2)
QakBot	QakBot can conduct brute force attacks to capture credentials.(Citation: Kroll Qakbot June 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Kaspersky QakBot September 2021)
Agrius	Agrius engaged in various brute forcing activities via SMB in victim environments.(Citation: Unit42 Agrius 2023)
APT39	APT39 has used Ncrack to reveal credentials.(Citation: FireEye APT39 Jan 2019)
	During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.(Citation: Dragos Crashoverride 2018)
Dragonfly	Dragonfly has attempted to brute force credentials to gain access.(Citation: CISA AA20-296A Berserk Bear December 2020)
Pysa	Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.(Citation: CERT-FR PYSA April 2020)
CrackMapExec	CrackMapExec can brute force supplied user credentials across a network range.(Citation: CME Github September 2018)
APT28	APT28 can perform brute force attacks to obtain credentials.(Citation: TrendMicro Pawn Storm 2019)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Microsoft Targeting Elections September 2020)

Mitigation	Description
Mitigations
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.
Account Use Policies	Configure features related to account use like login attempt lockouts, specific login times, etc.
Brute Force Mitigation	Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy can create a denial of service condition and render environments un-usable, with all accounts being locked-out permanently. Use multifactor authentication. Follow best practices for mitigating access to Valid Accounts Refer to NIST guidelines when creating passwords.(Citation: NIST 800-63-3) Where possible, also enable multi factor authentication on external facing services.
Multi-factor Authentication	Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
Password Policies	Set and enforce secure password policies for accounts.

Detection

Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.