Skip to content
Knowledge Hub/Article
Article

What Is a Brute Force Attack, and How Do You Prevent It?

We explain the types of brute force attack, online guessing versus offline cracking, NIST's attempt limit, the cost of lockout and the logs to watch.

Oğuzhan Gerçek··10 min read
What Is a Brute Force Attack, and How Do You Prevent It?

Short answer: A brute force attack is an attempt by someone who does not know a password to try large numbers of passwords until one works. MITRE ATT&CK groups the technique into four sub-techniques: password guessing, cracking stolen password hashes, trying a few common passwords against many accounts (password spraying) and trying username-password pairs leaked from other sites (credential stuffing). The core defenses are rate limiting, checking passwords against breached lists, MFA, storing passwords with slow hashing algorithms and monitoring failed sign-in logs.

What is a brute force attack?

According to MITRE ATT&CK's T1110 entry, adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes have been obtained. NIST's glossary also gives the cryptographic sense of the term: an attack that tries all possible combinations to find a match.

The weakness that makes the attack possible is described in MITRE's CWE-307: insufficient measures to prevent multiple failed authentication attempts within a short time frame. A07:2025 Authentication Failures, seventh in the OWASP Top 10:2025, likewise counts permitting brute force attacks that are not quickly blocked as a weakness.

Types of brute force attack

MITRE lists four sub-techniques:

  • Password guessing (T1110.001): An adversary with no knowledge of valid credentials guesses passwords, often working from a list of common ones.
  • Password cracking (T1110.002): Recovering usable passwords from captured password hashes; this is usually done on systems the adversary controls, outside the target network.
  • Password spraying (T1110.003): One or a few common passwords are tried against many accounts, so as not to trip the lockouts that hammering a single account would trigger. Adversaries may deliberately slow their attempts to stay under alerting thresholds.
  • Credential stuffing (T1110.004): Username-password pairs from breaches of other services are tried in turn, exploiting people's tendency to reuse the same password across personal and work accounts.

We cover the attack that asks users for their password instead of guessing it in our phishing article.

Online guessing versus offline password cracking

In NIST's definition, an online guessing attack is one in which the attacker makes repeated logon trials by guessing possible values of the authenticator output, such as a password or a code. Every attempt goes through the live sign-in service, which is where rate limits, MFA and logs come into play.

In an offline attack, the attacker obtains data, for example by breaking into a system and stealing security files, and analyzes it on a system of their own choosing. OWASP's examples include reaching the database through a SQL injection flaw or a stolen backup. The sign-in service's limits do not apply at this stage; the defense is to make every guess expensive. NIST's SP 800-63B-4 requires passwords to be stored in a form resistant to offline attacks, with a salt of at least 32 bits and a suitable password hashing scheme. OWASP considers fast algorithms such as SHA-256 unsuitable for password storage. Its first choice is Argon2id, then scrypt if Argon2id is not available, bcrypt for legacy systems and PBKDF2 where FIPS-140 compliance is required.

What do attackers target?

According to MITRE, password spraying typically goes after management services on commonly used ports: SSH (22/TCP), RDP (3389/TCP), SMB (445/TCP), LDAP, Kerberos, HTTP management interfaces and databases. SSO and cloud applications, along with externally facing email applications such as Office 365, are targets too (see our port article).

CISA's #StopRansomware Guide notes that threat actors often gain initial access through exposed and poorly secured remote services. The OWASP API Security Top 10 2023 also treats an API as vulnerable if it permits brute force against the same account without a CAPTCHA or lockout (see our API article). According to an October 2024 joint advisory from CISA, the FBI and the NSA, Iranian actors had been using brute force and password spraying since October 2023 to gain access to organizations in the healthcare, government, IT, engineering and energy sectors.

NIST SP 800-63B-4: password rules

NIST's SP 800-63B-4, published in July 2025, sets the following rules for passwords:

  • Length: Passwords used as a single factor must be at least 15 characters long, and passwords used only as part of MFA at least 8. A maximum length of at least 64 characters should be permitted.
  • No composition or expiry rules: Mixing character types must not be required, and passwords must not be changed periodically; a change is required when there is evidence of compromise.
  • Breached password check: New or changed passwords are compared against a blocklist, which may include passwords from previous breach corpuses, dictionary words and context-specific words such as the name of the service or the username.

Attempt limits: account lockout or throttling?

Under SP 800-63B-4, consecutive failed attempts with a given authenticator on a single account must not exceed 100; the authenticator is disabled when the limit is reached, and agencies may impose lower limits. Lockout comes at a cost: according to OWASP, it must not become a denial-of-service tool that locks out other users' accounts. The UK's National Cyber Security Centre (NCSC) therefore prefers throttling, a progressively increasing delay between login attempts, and recommends allowing 5 to 10 attempts where lockout is used.

NIST lists ways to make it harder for an attacker to lock out the legitimate user: a bot detection challenge before authentication, a wait that grows as the account approaches its limit (for example, from 30 seconds up to an hour) and risk-based authentication that looks at IP address, geolocation or request timing. Per-account lockout alone will not stop password spraying, because the attack spreads across accounts precisely to avoid lockouts. Smart lockout in Microsoft Entra ID distinguishes familiar from unfamiliar locations and does not count repeats of the same wrong password.

MFA, passkeys and remote access

Even if brute force produces the right password, a second factor can keep the attacker out. According to CISA, the extra layer MFA adds stops some common techniques such as password spraying, but push notifications are vulnerable to MFA fatigue (push bombing). The same fact sheet says the only widely available phishing-resistant authentication is FIDO/WebAuthn; we compare the methods in our MFA article. According to the FIDO Alliance, passkeys replace passwords with cryptographic key pairs, so there is no password left to steal.

For remote access, the first rule is not to expose the service to the internet. CISA advises against exposing services such as RDP on the web and calls for closing unused RDP ports, account lockout, MFA and logging of RDP login attempts; it also expects MFA on all VPN connections. Our VPN article covers VPNs and ZTNA, our network security article the zero trust approach and our IAM article the identity infrastructure. We handle these layers in our network security and identity management services.

How to detect a brute force attack

On Windows, every failed logon attempt generates event 4625; logon type 10 indicates a Remote Desktop sign-in and type 3 a network sign-in. According to MITRE, adversaries may turn to LDAP and Kerberos attempts, which are less likely to trigger 4625. That is why 4771 events with failure code 0x18 should also be monitored on Active Directory domain controllers; Microsoft notes that this code can indicate a brute force attack on the account password.

MITRE's detection guidance looks for these patterns: a successful sign-in after a run of failures, failures with the same password across many accounts in a short window, and different username-password pairs coming from a single IP address. Microsoft Entra ID Protection compares the time between two sign-ins from distant locations with the time it would take to travel between them (atypical travel). According to MITRE, however, an adversary blocked by a location-based rule may move their infrastructure to match the victim's location.

According to Microsoft's January 2024 disclosure, the nation-state actor Midnight Blizzard used password spraying to compromise a legacy test tenant account. Microsoft's guidance for responders adds that the account did not have MFA enabled and that the actor made a low number of attempts from a vast number of IP addresses also used by legitimate users (residential proxies). We cover correlation rules in our SIEM and SOC article and handle detection and response in our security operations service.

Frequently asked questions

What does brute force mean? It means trying possible values one by one until the right password or key is found.

What is a brute force algorithm? In computer science, it is an approach that solves a problem by trying possible solutions one after another, and NIST's algorithm dictionary describes it as inefficient. The attack applies the same idea to passwords.

What is the difference between credential stuffing and password spraying? Credential stuffing tries username-password pairs leaked from another service. Password spraying tries a few common passwords against many accounts.

What is password cracking? It is recovering plaintext passwords from captured password hashes. Because the attacker does it on their own system, sign-in attempt limits do not apply; the defense is to store passwords with slow algorithms such as Argon2id.

How do you prevent a brute force attack? Combine rate limiting, breached password checks and MFA or passkeys. Keep remote access off the internet and store passwords with slow hashing algorithms.

Sources