Password Guessing
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts. Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when guessing passwords. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1521
Series of authentication failures (Event ID 4625) targeting the same or similar user accounts over time from one or more remote IPs
- AN1522
Repeated failed SSH login attempts followed by a possible success from the same remote host
- AN1523
Series of failed logins from loginwindow or sshd with repeated usernames or password prompts
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.