Brute Force: Password Cracking (Windows)

Description

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Products, Sensors, and Dependencies

ProductDependenciesData sourceAccess requiredProtocolData CollectedNotes
Tenable.adActive DirectoryAuthenticated AD userLDAP/S(389/636)Domain User
Tenable.adPassword SyncActive DirectoryPrivileged AD userRPC (135 + high ports)User Password

References

T.ad DCSync feature

Attack Path Technique Details

Framework: MITRE ATT&CK

Family: Credential Access

Technique: Brute Force

Platform: Windows

Products Required: Tenable.ad

Tenable Release Date: 2022 Q3