Password Cracking (T1110.002) is a sub-technique of Brute Force in the credential access tactic. MITRE lists identity providers, Linux, macOS, network devices, Office suites and Windows.
Cracking happens after hashes have been stolen. The guessing is offline, which is the main reason it is hard to see.
How attackers use it
MITRE describes recovering usable credentials, such as plaintext passwords, when password hashes have been obtained. Credential dumping can supply hashes, though that may only get an adversary so far when pass-the-hash is not an option. Adversaries may also take hashed credentials for network devices from configuration repositories.
Methods include systematically guessing the passwords that produce a given hash, or using a pre-computed rainbow table. MITRE notes cracking is usually done on adversary-controlled systems outside the target network. The recovered plaintext may then be used to log in to systems and services where the account has access.
How to detect it
Because the work happens elsewhere, MITRE's strategy looks at what happens before and after. Its analytics describe:
- Use of hash cracking tools after credential dumping, with high CPU or GPU use, or access to password hash files by unsigned binaries.
- On Linux, hash cracking binaries or scripts run after access to the shadow file.
- Sudden valid logins from accounts whose credentials were dumped earlier but had not signed in successfully before, lined up with the timeline of suspected cracking.
- Successful command line or web logins to routers and switches from accounts that were previously dumped.
So the useful detections are upstream (who read the hash store) and downstream (a long dormant account signs in successfully for the first time).
How to reduce the risk
MITRE lists two mitigations:
- Password policies. Follow NIST guidelines. Length and not reusing passwords make cracking expensive.
- Multi-factor authentication, including on external services, so a cracked password is not enough.
Protect hash stores and configuration repositories, and rotate credentials after any suspected dump.
Quick check
Why is cracking hard to detect directly?
It is usually done offline on adversary-controlled systems, so you see the dump before and the login after, not the cracking.
What downstream signal does MITRE describe?
A valid login from an account whose credentials were dumped earlier but that had not logged in successfully before.
Sources
- MITRE ATT&CK, Brute Force: Password Cracking (T1110.002)
