Brute force / password guessing

Trying many passwords against an account until one works

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1110.001 · Brute Force Credentials of single Active Directory domain user via LDAP against domain controller (NTLM or Kerberos) · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1110.001 -TestGuids c2969434-672b-4ec8-8df0-bbb91f40e250 -TimeoutSeconds 120'

ATT&CK T1110.001 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.001 -Tool atomic -RunId run-2026-10-14-021 -Command 'Invoke-AtomicTest T1110.001 -TestGuids c2969434-672b-4ec8-8df0-bbb91f40e250 -TimeoutSeconds 120'

ATT&CK T1110.001 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.001 -Tool atomic -RunId run-2026-10-18-022 -Command 'Invoke-AtomicTest T1110.001 -TestGuids c2969434-672b-4ec8-8df0-bbb91f40e250 -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-30 · detected in 53s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	PowerShell LDAP bind loop over a credential list (LdapConnection.Bind per password) -- password guessing / spraying -- T1110.001
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100440 (level 8) lab rule — PowerShell LDAP bind loop over a credential list (LdapConnection.Bind per password) -- password guessing / spraying -- T1110.001
✓ Wazuh 100441 (level 8) lab rule — PowerShell LDAP bind loop over a credential list (LdapConnection.Bind per password) -- password guessing / spraying (Security 4688 arm) -- T1110.001

Plus 10 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~5180 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27 · detected in 71s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Event · EID 16384	Software protection service scheduled successfully.
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~70142 incidental alerts/hour — tune against this.

Classification

30 values: 9 reviewed, 2 lab-measured, 13 imported, 6 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	CloudOn-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	User Account Authentication

Detection & response

Mitigated by 20

M1027 attack-mitigation
M1032 attack-mitigation
M1036 attack-mitigation
M1051 attack-mitigation
D3-AEM d3fend
D3-ANCI d3fend
D3-CCSA d3fend
D3-CDP d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-OPM d3fend
D3-OTP d3fend
D3-PR d3fend
D3-PWA d3fend
D3-RIC d3fend
D3-SPP d3fend

Detected by 6

DET0551 attack-detection-strategy
1883444f-084b-419b-ac62-e0d0c5b3693f sigma
71886b70-d7b4-4dbf-acce-87d2ca135262 sigma
aaafa146-074c-11eb-adc1-0242ac120002 sigma
100440 wazuh
100441 wazuh

Tested by 8

09480053-2f98-4854-be6e-71ae5f672224 atomic
4097bc00-5eeb-4d56-aaf9-287d60351d95 atomic
59dbeb1a-79a7-4c2a-baf4-46d0f4c761c4 atomic
5a51ef57-299e-4d62-8e11-2d440df55e69 atomic
abcde488-e083-4ee7-bc85-a5684edd7541 atomic
ba1bf0b6-f32b-4db0-b7cc-d78cacc76700 atomic
c2969434-672b-4ec8-8df0-bbb91f40e250 atomic
ed6c2c87-bba6-4a28-ac6e-c8af3d6c2ab5 atomic

Attack relationships

Parent: Broken authentication (API)
Parent: WPS PIN brute force

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-021`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-022`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-016`	partially-detected	atomic	windows	2026-10-27
`run-2026-10-30-005`	detected	atomic	windows	2026-10-30

run-2026-10-14-021 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=16 max_level=15 dwell_s=90
run-2026-10-18-022 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1502 max_level=15 dwell_s=90
run-2026-10-27-016 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1812 max_level=15 dwell_s=90
run-2026-10-30-005 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=141 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1110/
attack: T1110.001 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 314 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 12 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-021 (partially-detected) for T1110.001: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-022 (partially-detected) for T1110.001: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-016 (partially-detected) for T1110.001: no alert matched the expected technique
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-005 (detected): Wazuh rule(s) 100440, 100441 fired on T1110.001 within the detonation window
PowerShell LDAP bind loop over a credential list (LdapConnection.Bind per password) -- password guessing / spraying (Security 4688 arm) -- T1110.001