暴力破解是攻击者通过系统化猜测凭证获取账户访问权限的攻击技术，可分为在线交互式认证尝试和离线密码哈希解密两种模式。传统防御手段主要依赖监控异常登录失败事件、部署账户锁定策略、分析认证流量特征等方法进行检测。对于离线哈希破解，由于攻击发生在防御体系之外，主要依赖加强密码哈希存储安全、使用强加密算法等措施进行预防。
为应对基于行为分析和阈值告警的防御体系，攻击者持续演进暴力破解技术的隐蔽性。通过将集中式攻击分布式化、在线行为协议化、破解过程离线化等策略，实现攻击特征的深度隐藏。新型匿迹技术注重平衡攻击效率与隐蔽性，在维持破解成功率的同时，将攻击痕迹稀释于合法业务交互或转移到防御盲区。
现有暴力破解匿迹技术的核心创新体现在三个维度：首先在攻击架构层面，采用分布式节点集群与云原生资源实现攻击源的动态隐匿，如分布式低频破解通过全球节点轮换规避IP黑名单；其次在协议交互层面，通过深度协议逆向与流量特征克隆实现攻击行为的合法化伪装，如协议模拟破解完全复现OAuth认证流程；最后在计算模式层面，将关键攻击阶段转移至防御边界之外，如离线哈希破解彻底规避在线检测机制。这些技术通过时空解耦、协议寄生、资源异构等手法，重构了暴力破解的攻击特征分布，使得传统基于单点检测、规则匹配的防御体系面临严峻挑战。
匿迹技术的发展迫使防御体系向多维关联分析方向演进。需构建跨系统的凭证泄露监控网络，实现哈希数据库外泄的实时预警；部署基于用户行为基线的认证异常检测，识别低频分布式攻击模式；同时强化协议级交互验证机制，防范深度伪装的协议模拟攻击。防御方还需加强密码学安全实践，推广抗暴力破解的加密算法与存储方案。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ❌ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过协议逆向工程构建符合规范的认证请求，精确模拟合法客户端的交互特征。例如在协议模拟暴力破解中，完整复现OAuth令牌刷新流程，包含合法的重定向机制和CSRF令牌使用，使攻击流量在协议层面与正常业务流量无法区分。
在分布式攻击架构中，节点间通信采用AES-256等强加密算法保护指令传输，破解结果通过Tor网络回传。离线哈希破解过程中，使用加密容器存储敏感哈希数据，确保即便攻击基础设施被查获，核心数据仍不可解析。
分布式低频破解通过全球云节点实施长周期、低频率的认证尝试，单个节点的日均尝试次数控制在目标系统告警阈值之下。结合智能节奏控制算法，根据目标时区的工作周期调整攻击时段，使破解行为的时间分布特征与正常用户登录模式高度吻合。
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.[1] |
| G1030 | Agrius |
Agrius engaged in various brute forcing activities via SMB in victim environments.[2] |
| G0007 | APT28 |
APT28 can perform brute force attacks to obtain credentials.[3][4][5] |
| G0082 | APT38 |
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[6] |
| G0087 | APT39 | |
| G0096 | APT41 |
APT41 performed password brute-force attacks on the local admin account.[8] |
| S0572 | Caterpillar WebShell |
Caterpillar WebShell has a module to perform brute force attacks on a system.[9] |
| S0220 | Chaos |
Chaos conducts brute force attacks against SSH services to gain initial access.[10] |
| S0488 | CrackMapExec |
CrackMapExec can brute force supplied user credentials across a network range.[11] |
| G0105 | DarkVishnya |
DarkVishnya used brute-force attack to obtain login data.[12] |
| G0035 | Dragonfly |
Dragonfly has attempted to brute force credentials to gain access.[13] |
| G1003 | Ember Bear |
Ember Bear used the |
| G0053 | FIN5 |
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.[15][16] |
| G0117 | Fox Kitten |
Fox Kitten has brute forced RDP credentials.[17] |
| G1001 | HEXANE |
HEXANE has used brute force attacks to compromise valid credentials.[18] |
| S0599 | Kinsing | |
| G0049 | OilRig |
OilRig has used brute force techniques to obtain credentials.[20][21] |
| C0022 | Operation Dream Job |
During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.[22] |
| S0378 | PoshC2 |
PoshC2 has modules for brute forcing local administrator and AD user accounts.[23] |
| S0583 | Pysa |
Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[24] |
| S0650 | QakBot |
QakBot can conduct brute force attacks to capture credentials.[25][26][27] |
| G0010 | Turla |
Turla may attempt to connect to systems within a victim's network using |
| ID | Mitigation | Description |
|---|---|---|
| M1036 | Account Use Policies |
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[29] Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.[30] |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services. |
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies.[31] |
| M1018 | User Account Management |
Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. |
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Analytic 1 - Command-line tools used for brute force attacks.
|
| DS0002 | User Account | User Account Authentication |
Monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. Analytic 1 - Multiple failed logon attempts across different accounts.
|