MITRE ATT&CK - Técnica

T1110: Brute Force

Brute Force (T1110) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1110 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Brute Force deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Credential Access. As plataformas mapeadas pela MITRE incluem Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite e mais 2. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Credential Access
Plataformas MITRE Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Brute Force automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma