Category hub: Credentials, identity and exposure

In one sentence: A brute force attack is an attacker guessing passwords again and again, usually with software, until one works.

What is a brute force attack?

MITRE ATT&CK describes brute force as an adversary systematically guessing a password using a repetitive or iterative mechanism when the password is unknown. It can happen online, by talking to a login page, or offline, against stolen password “hashes” (scrambled copies of passwords).

MITRE groups four related techniques under brute force: password guessing, password cracking, password spraying and credential stuffing. This entry covers the general idea. The other two have their own entries.

How it works

1. The attacker finds a login that faces the internet, such as Microsoft 365, a VPN or remote desktop. MITRE notes commonly targeted services include cloud and single sign-on applications and email systems such as Office 365.
2. Software tries many passwords against an account, or one password against many accounts.
3. If a guess works, the attacker signs in as the user.
4. From there they can read email, move to other systems, or sell the access.

MITRE also notes that guessing can cause many failed sign-ins and account lockouts, which is how defenders often spot it.

Who it affects and how badly

Any account reachable from the internet can be tried.

• Sole trader to 10 staff: one weak mailbox password can give an attacker your email and your clients’ details.
• 10 to 50 and 50 to 250 staff (accountancy, trades, retail, SaaS start-ups): an admin or finance account compromised this way can lead to fraud, data exposure and days of clean-up.
• 250 plus and regulated firms: compromised accounts holding personal data can lead to ICO notification, and unavailable systems if the attacker moves further.

Real examples

In July 2021 the NSA, CISA, FBI and the UK’s NCSC published a joint advisory on a Russian GRU brute force campaign against enterprise and cloud environments. It describes the actors using a Kubernetes cluster to scale guessing attempts and, once they had credentials, using known vulnerabilities for further access: CISA alert. Reporting on the advisory said multi-factor authentication was the most effective mitigation.

How to detect it

• In Microsoft Entra sign-in logs, look for bursts of failed sign-ins and the lockout error code 50053, which means the account was locked.
• Check for failures from many places, or from unfamiliar locations.
• Watch for a successful sign-in straight after many failures. That is the one that matters.
• Smart lockout in Microsoft Entra ID is on by default. It uses familiar and unfamiliar locations, with separate counters, to separate attackers from real users.

How to fix or prevent it

1. Turn on multi-factor authentication for every account that faces the internet.
2. Block legacy sign-in methods that cannot do multi-factor authentication, using Conditional Access.
3. Keep smart lockout on. In Entra the default is 10 failed attempts before lockout in Azure Public tenants, and you can change it under Authentication methods, Password protection.
4. Use a strong, separate password for each account, as the NCSC advises.
5. Avoid exposing management services such as remote desktop directly to the internet, because MITRE lists them as commonly targeted.
6. Alert on repeated failures and on lockouts.

Related terms

• password-spraying
• credential-stuffing
• multi-factor-authentication
• account-takeover
• rate-limiting
• conditional-access

Frequently asked questions

What is a brute force attack?
It is an attacker guessing passwords again and again, usually with software, until one works.

How can I spot a brute force attack?
Look for bursts of failed sign-ins, lockouts such as Entra error code 50053, and a successful sign-in straight after many failures.

What stops a brute force attack?
Turn on multi-factor authentication, block legacy sign-in methods, keep smart lockout on and use a strong, separate password for each account.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy breach exposure monitoring.

Service page: Breachy breach exposure monitoring.