Detect Brute Force in Microsoft Sentinel
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Threat actors including Fox Kitten, APT38, APT41, OilRig, and Turla have used brute force techniques against RDP, SSH, SMB, and web services.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1110 Brute Force
- Canonical reference
- https://attack.mitre.org/techniques/T1110/
KQL Detection Query
// Brute Force Detection — Multiple failed logons followed by success, or high-volume failures
// Part 1: Windows Security Event failed logons (Event ID 4625)
let FailedLogonThreshold = 10;
let TimeWindowMinutes = 10;
let BruteForceAccounts =
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| where LogonType in (3, 10) // Network and RemoteInteractive
| summarize FailedCount = count(),
TargetAccounts = dcount(TargetAccount),
TargetAccountList = make_set(TargetAccount, 20),
FirstFailure = min(TimeGenerated),
LastFailure = max(TimeGenerated)
by IpAddress, Computer, bin(TimeGenerated, TimeWindowMinutes * 1m)
| where FailedCount >= FailedLogonThreshold;
// Part 2: Enrich with successful logon after failures (compromise indicator)
let SuccessAfterFailure =
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624
| where LogonType in (3, 10)
| project SuccessTime = TimeGenerated, IpAddress, TargetAccount, Computer;
BruteForceAccounts
| join kind=leftouter (
SuccessAfterFailure
) on IpAddress, Computer
| extend SuccessAfterBruteForce = isnotempty(SuccessTime) and SuccessTime > LastFailure
| extend Severity = case(
SuccessAfterBruteForce == true, "Critical",
TargetAccounts > 5, "High", // Password spray pattern
FailedCount >= 50, "High",
"Medium"
)
| project FirstFailure, LastFailure, Computer, IpAddress, FailedCount, TargetAccounts,
TargetAccountList, SuccessAfterBruteForce, SuccessTime, Severity
| sort by SuccessAfterBruteForce desc, FailedCount descDetects brute force credential attacks using Windows Security Event ID 4625 (failed logon) with configurable thresholds. Identifies both vertical brute force (many attempts against one account) and horizontal password spray (few attempts across many accounts) by tracking unique target account counts. Enriches results with Event ID 4624 (successful logon) to flag the critical case where brute force succeeded. LogonType 3 (Network) and 10 (RemoteInteractive/RDP) are targeted as the most common brute force vectors. Severity is elevated to Critical when a successful logon follows a burst of failures from the same source.
Data Sources
Required Tables
False Positives & Tuning
- Misconfigured service accounts with expired or recently changed passwords generating automatic logon failures in batch
- Legitimate penetration testing or red team exercises using tools like Hydra, Medusa, or CrackMapExec against authorized targets
- Users who forget their password and repeatedly attempt login before resetting, particularly after travel or long absence
- Load balancers or multi-hop proxies causing multiple logon attempts to appear from a single source IP
- Password manager applications failing to update cached credentials after a password rotation, generating repeated failures
Other platforms for T1110
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1RDP Brute Force Simulation with Crowbar
Expected signal: On the target Windows host: Security Event ID 4625 (LogonType=10, RemoteInteractive) for each failed attempt, with IpAddress showing the attacker IP. If lockout policy is enabled and threshold exceeded: Event ID 4740 (account locked out). Network logs: multiple TCP connections to port 3389 from attacker IP in rapid succession.
- Test 2SSH Brute Force with Hydra
Expected signal: On the target Linux host: /var/log/auth.log entries 'Failed password for root from <attacker-ip> port <port> ssh2'. If using auditd: type=USER_AUTH msg entries with res=failed. Sysmon for Linux (if deployed): Event ID 3 (network connection) on the attacker side. SIEM via Syslog forwarder: linux_secure sourcetype or syslog with 'Failed password' pattern.
- Test 3Active Directory Password Spray with PowerShell
Expected signal: On Domain Controller: Security Event ID 4625 (LogonType=3, Network) for each failed account, SubStatus 0xC000006D (wrong password) or 0xC000006A (wrong password for correct username). Caller IP address will be the workstation running the spray. Security Event ID 4771 (Kerberos pre-auth failure) if using Kerberos authentication. Timing will show evenly spaced failures 500ms apart — distinctive automated tool pattern.
- Test 4NTLM Brute Force via SMB with CrackMapExec
Expected signal: Target Windows host: Security Event ID 4625 (LogonType=3, Network, AuthenticationPackageName=NTLM) for each failed credential. Domain Controller: Security Event ID 4776 (NTLM authentication attempt, error code 0xC000006A for wrong password) with Workstation field showing attacker hostname. Network: multiple TCP connections to port 445 (SMB) from attacker IP. CME results show [*] for failure and [+] for success in its output.
References (10)
- https://attack.mitre.org/techniques/T1110/
- https://www.microsoft.com/en-us/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
- https://learn.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
- https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf
- https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1110/T1110.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security
- https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-foreign-threat-actor-conducting-large-scale-spear-phishing-campaign-with-rdp-attachments.pdf
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
Unlock Pro Content
Get the full detection package for T1110 including response playbook, investigation guide, and atomic red team tests.