T1110.001 — Password Guessing

Tactic: Credential Access · Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.…

Sub-technique of Brute Force (T1110).

Sigma detection rules (6)

title: "T1110.001 Brute Force: Password Guessing"
id: a20a9663-3887-425a-83aa-7d4dc9924c00
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Data Component: User Account Authentication; baseline tier: windows-eventid.) Tune using: TimeWindow, UsernamePattern, SourceIPThreshold.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-01-27
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4625'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  timeframe: 5m

  condition: selection and not filter_system_account | count() by IpAddress > 10

falsepositives:
  - Misconfigured service or application repeatedly retrying a stale credential against the same source IP; tune SourceIPThreshold and TimeWindow to the environment's baseline lockout policy.

level: medium

title: "T1110.001 Brute Force: Password Guessing"
id: 16593b56-0e28-4caa-82fc-b4574138f083
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) A single failed-password log line is not evidence of brute forcing; this rule now matches only the raw failure event and defers the actual guessing verdict to the companion correlation rule below, which counts failures per source IP within a 5-minute window. Tune using: PortScope, UserScope, AttemptThreshold.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  product: linux
  service: syslog

detection:
  selection:
    Message|contains: 'Failed password for'

  condition: selection

falsepositives:
  - A single match is expected to include normal user typos and is not itself actionable; only the companion correlation rule''s threshold breach (5+ failures per source IP within 5 minutes) should be treated as a brute-force indicator. PAM/sshd auth failures are logged to syslog, not auditd.

level: informational
---
title: "T1110.001 Brute Force: Password Guessing - Failed Auth Attempt Threshold"
id: 7f3c2e1a-9b4d-4a6e-9c2f-5d1e9a7b3c60
description: 'Correlation companion for 16593b56-0e28-4caa-82fc-b4574138f083: counts failed password authentication events per source IP within a 5-minute window, approximating password-guessing/brute-force behavior that a single log line cannot express.'
status: experimental
correlation:
  type: event_count
  rules:
    - 16593b56-0e28-4caa-82fc-b4574138f083
  group-by:
    - src_ip
  timespan: 5m
  condition:
    gte: 5
level: high

title: "T1110.001 Brute Force: Password Guessing"
id: feb297fe-7a41-4fb4-82db-4353cd5c54b8
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AuthMechanism, FailurePattern.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-06-28
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/su'

  condition: selection

falsepositives:
  - Normal privilege elevation via su by legitimate administrators; single-event visibility cannot distinguish guessing from a correct first attempt.

level: medium

title: "T1110.001 Brute Force: Password Guessing"
id: f00567b5-e736-4e9a-834d-dd394fdc50ea
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AppContext, EmailPattern.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  product: gcp
  service: audit

detection:
  selection:
    protoPayload.methodName: 'google.login.LoginService.loginFailure'

  condition: selection

falsepositives:
  - Users mistyping passwords or authenticating with recently expired credentials, producing legitimate repeated failures.

level: medium

title: "T1110.001 Brute Force: Password Guessing"
id: 8957e796-51f5-4409-bcbb-f1edaec2cf70
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: GeoRiskScore, MFAStatus.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '50126'
  risky:
    RiskLevelDuringSignIn: 'high'

  condition: selection and risky

falsepositives:
  - Rare, but stale credentials stored in scripts can generate repeated low risk failures that should be excluded via tuning.

level: high

title: "T1110.001 Brute Force: Password Guessing"
id: d23b1d4a-8795-4096-964d-e5c455f8fe6d
description: 'Password Guessing via Multi-Source Authentication Failure Correlation. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: InterfaceType, FailedAttemptThreshold.'
references:
  - https://attack.mitre.org/techniques/T1110/001
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.001

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_failed:
    Message|contains:
      - '%SEC_LOGIN-4-LOGIN_FAILED'
      - 'authentication failed'
      - 'Invalid password'
      - 'Bad password'
  selection_remote:
    Message|contains:
      - 'via SSH'
      - 'via TELNET'
      - 'via VTY'
  condition: selection_failed and selection_remote

falsepositives:
  - A user with a saved but outdated password in a terminal client repeatedly reconnecting can trigger repeated failures without malicious intent.

level: medium

Related sub-techniques

• T1110.003 Password Spraying
• T1110.004 Credential Stuffing
• T1110.002 Password Cracking

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1110.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan