What is it?
Brute force is systematic guessing of passwords, keys, PINs, or other secrets. Online attacks submit guesses to a live service; offline attacks test guesses against stolen hashes or encrypted data without touching the target service.
How it works in plain English
Use this three-part model to understand the attack without memorizing a tool name.
The system accepts a credential, token, ticket, recovery decision, or identity assertion as proof of who the requester is.
The attacker obtains, guesses, forges, replays, or changes that authentication material.
Focus on how the identity was acquired, where it was used, what device and network context changed, and what happened immediately after success.
Worked example: how the sequence may look
A target login, account, encrypted file, or password hash.
Generate and submit candidate secrets.
Authentication failures and successes, ticket or token activity, MFA events, and account changes.
Threshold failures by user, source, endpoint, protocol, and time.
If successful, the attacker may continue with Cloud Account Takeover. This is a possibility, not a guaranteed next step.
This is a defensive learning scenario. Real incidents vary, and the listed outcome is only one possible path.
Why do attackers use it?
Exploit weak or predictable credentials.
Recover plaintext from stolen password hashes.
Gain access without exploiting a software vulnerability.
Automate account attacks at large scale.
Prerequisites
A target login, account, encrypted file, or password hash.
A candidate list or generation strategy.
For online attacks, reachability and tolerance for rate limiting.
For offline attacks, captured data and suitable compute.
Attack path possibilities
Attack chains are not fixed. These links show common possibilities to investigate before and after this behavior.
A targeted message links to credential theft or malware delivery.
T1110.001 Password GuessingCommon or targeted passwords are tested against one account.
T1003.001 LSASS Credential DumpingCredential material is extracted from the Windows security process.
T1557 Adversary-in-the-Middle PhishingA reverse proxy captures credentials, MFA exchanges, and session cookies in real time.
Stolen credentials, tokens, or recovery paths control a cloud identity.
T1021 Remote ServicesRDP, SMB, SSH, WinRM, VNC, or similar services are used to access remote systems.
T1550.002 Pass-the-HashA stolen password hash is used directly for authentication without recovering the plaintext.
T1550.003 Pass-the-TicketA stolen Kerberos ticket is reused to access resources without the account password.
Step-by-step attack flow
Identify the authentication target and password policy.
Choose online guessing, dictionary, mask, or exhaustive search.
Generate and submit candidate secrets.
Observe success or compare hashes offline.
Tune candidates using organization-specific words and patterns.
Use recovered credentials and test authorized reach.
MITRE ATT&CK mapping
ATT&CK is updated over time. Verify the live technique before operationalizing a detection.
Logs and artifacts
Authentication failures and successes, ticket or token activity, MFA events, and account changes.
Identity-provider risk, device, source-network, conditional-access, and session telemetry.
Endpoint evidence of credential access, browser data access, or security-process interaction.
Realistic log examples
These records use realistic field names and formats but synthetic organizations, users, addresses, and identifiers. A single event is not proof; correlate time, identity, source, target, and the resulting action.
Failed authentication; useful for guessing, spraying, exposed remote services, and account targeting.
2026-07-16T14:22:31Z EventID=4625 Computer=DC01.corp.example
TargetUserName=j.singh TargetDomainName=CORP LogonType=3
AuthenticationPackageName=NTLM WorkstationName=WKSTN-442
IpAddress=203.0.113.48 IpPort=51842
Status=0xC000006D SubStatus=0xC000006A FailureReason="Unknown user name or bad password"Threshold failures by user, source, endpoint, protocol, and time.
Cloud sign-in context including identity, application, source, result, device, and conditional access.
2026-07-16T14:24:51Z UserPrincipalName=j.singh@corp.example
AppDisplayName="Office 365 Exchange Online" IPAddress=203.0.113.48
ResultType=50126 ResultDescription="Invalid username or password"
ClientAppUsed=Browser ConditionalAccessStatus=notApplied
DeviceDetail.operatingSystem=Windows Location=SGLook for accelerating rates and systematic username/password patterns.
Remote authentication and PAM outcome with source address and account.
Jul 16 14:22:33 web02 sshd[24817]: Failed password for invalid user backup
from 203.0.113.48 port 51842 ssh2
Jul 16 14:22:37 web02 sshd[24817]: Failed password for deploy
from 203.0.113.48 port 51842 ssh2Correlate lockouts with sources and user agents.
- Who or what identity acted?
- From which device, process, IP, or workload?
- What target and operation were involved?
- Did it fail, succeed, or change state?
- What correlated event happened immediately before and after?
Detection logic / SIEM queries
Threshold failures by user, source, endpoint, protocol, and time.
Look for accelerating rates and systematic username/password patterns.
Correlate lockouts with sources and user agents.
Alert on a success following abnormal failures.
SecurityEvent
| where EventID in (4624, 4625)
| summarize Failures=countif(EventID == 4625),
Successes=countif(EventID == 4624) by Account, IpAddress, bin(TimeGenerated, 15m)
| where Failures >= 20 or (Failures >= 8 and Successes > 0)Mitigations
Use MFA, progressive delay, rate limiting, and smart lockout.
Store passwords with salted memory-hard password hashing.
Disable defaults and change default credentials.
Block common and breached passwords.
Restrict management interfaces to trusted networks.
Real-world examples
Internet-facing SSH and RDP are continuously targeted by automated bots.
The 2016 Ukraine electric power attack included scripted RPC authentication attempts.
Ransomware crews have brute-forced VPN, RDP, and management consoles.
Common questions
01What makes Brute Force possible?
A trust assumption fails: an identity, input, component, network message, user decision, or software relationship is accepted without enough verification.
02What should a defender collect first?
Start with logs closest to the decision point, then add identity, endpoint, network, and control-plane context.
03How should I study this attack?
Learn the concept, identify prerequisites, map observable steps, write a detection hypothesis, and validate it safely in a lab.