Dictionary attack
Guessing from a wordlist of common or leaked passwords
categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured
Classification
29 values: 9 reviewed, 14 imported, 6 derived. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Credential Access |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | User Account Authentication |
Detection & response
Mitigated by 20
- M1027 attack-mitigation
- M1032 attack-mitigation
- M1036 attack-mitigation
- M1051 attack-mitigation
D3-AEMd3fendD3-ANCId3fendD3-CCSAd3fendD3-CDPd3fendD3-CHd3fendD3-CRd3fendD3-CROd3fendD3-CTSd3fendD3-DUCd3fendD3-MFAd3fendD3-OPMd3fendD3-OTPd3fendD3-PRd3fendD3-PWAd3fendD3-RICd3fendD3-SPPd3fend
Detected by 4
- DET0551 attack-detection-strategy
1883444f-084b-419b-ac62-e0d0c5b3693fsigma71886b70-d7b4-4dbf-acce-87d2ca135262sigmaaaafa146-074c-11eb-adc1-0242ac120002sigma
Tested by 8
09480053-2f98-4854-be6e-71ae5f672224atomic4097bc00-5eeb-4d56-aaf9-287d60351d95atomic59dbeb1a-79a7-4c2a-baf4-46d0f4c761c4atomic5a51ef57-299e-4d62-8e11-2d440df55e69atomicabcde488-e083-4ee7-bc85-a5684edd7541atomicba1bf0b6-f32b-4db0-b7cc-d78cacc76700atomicc2969434-672b-4ec8-8df0-bbb91f40e250atomiced6c2c87-bba6-4a28-ac6e-c8af3d6c2ab5atomic
Attack relationships
- Parent: Broken authentication (API)
- Parent: WPS PIN brute force
Framework references
- Primary source: https://attack.mitre.org/techniques/T1110/
- attack: T1110.001 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 315 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 12 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)