title: Brute Force (T1110)
id: df00tech-t1110
status: experimental
description: "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Threat actors including Fox Kitten, APT38, APT41, OilRig, and Turla have used brute force techniques against RDP, SSH, SMB, and web services."
references:
  - https://attack.mitre.org/techniques/T1110/
  - https://df00tech.com/detections/T1110
author: df00tech
date: 2026/04/17
tags:
  - attack.t1110
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - Misconfigured service accounts with expired or recently changed passwords generating automatic logon failures in batch
  - "Legitimate penetration testing or red team exercises using tools like Hydra, Medusa, or CrackMapExec against authorized targets"
  - "Users who forget their password and repeatedly attempt login before resetting, particularly after travel or long absence"
  - Load balancers or multi-hop proxies causing multiple logon attempts to appear from a single source IP
  - "Password manager applications failing to update cached credentials after a password rotation, generating repeated failures"
level: high