{
  "family": "bruteforce",
  "sample_count": 13,
  "category": "hacktool",
  "description": "BruteForce (classified across antivirus engines as HackTool:Win32/BruteForce and Tool:Win32/BruteForce) is a multi-protocol authentication credential-cracking tool used by threat actors and penetration testers to gain unauthorized initial access and execute internal lateral movement. Designed for high-concurrency dictionary and rainbow-table attacks, BruteForce targets Windows administrative services, including Remote Desktop Protocol (RDP - port 3389), Server Message Block (SMB - port 445), MSSQL (port 1433), and SSH (port 22). Threat actors deploy it on internet-facing scanning servers or compromised internal workstations to systematically iterate through wordlists of usernames and passwords, generating alerts across security event logs (Event IDs 4625).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/BruteForce",
    "Tool:Win32/BruteForce",
    "Win32/BruteForce",
    "RDP BruteForce Tool",
    "BruteForce Password Cracker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/BruteForce?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BruteForce is an automated password cracking tool used by attackers to guess credentials on services like RDP, SMB, and SQL."
      }
    },
    {
      "@type": "Question",
      "name": "Which protocols are targeted by BruteForce tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remote Desktop Protocol (RDP), Server Message Block (SMB), SSH, FTP, and Microsoft SQL Server (MSSQL)."
      }
    },
    {
      "@type": "Question",
      "name": "How does BruteForce facilitate lateral movement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Once inside a corporate network, it scans internal subnets to guess local administrator credentials across neighboring hosts."
      }
    },
    {
      "@type": "Question",
      "name": "What Windows event logs indicate a brute-force attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "High volumes of Event ID 4625 (failed logon attempts) followed by Event ID 4624 (successful logon) from the same IP."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against BruteForce tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce multi-factor authentication (MFA), account lockout thresholds, strong password policies, and disable public-facing RDP."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1110.001",
    "T1110.003",
    "T1021.001",
    "T1021.002",
    "T1046",
    "T1078"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing",
      "tactic": "Credential Access"
    },
    {
      "id": "T1110.002",
      "name": "Brute Force: Password Cracking (Offline)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1110.003",
      "name": "Brute Force: Password Spraying",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts (The goal of the attack)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "If the alert indicates an active network brute-force attack, immediately isolate the targeted system or block the source IP address at the firewall.",
    "Analyze Windows Security Event Logs (Event ID 4625) to determine which accounts are being targeted; if a successful login (4624) is found from the attacking IP, consider that account compromised.",
    "If an offline cracking tool (like Hashcat) is found, isolate the machine to determine *how* the attacker obtained the password hashes in the first place (e.g., did they dump LSASS?).",
    "Enforce a mandatory enterprise-wide password reset if Domain Admin hashes were potentially cracked."
  ],
  "what_to_avoid": [
    "Do not ignore the alert simply by deleting the tool; the presence of the tool indicates an attacker is already inside the network attempting to escalate privileges.",
    "Avoid relying solely on account lockouts to stop brute-forcing; modern attackers use 'Password Spraying' (trying one common password across all users) to avoid triggering lockout policies."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/BruteForce",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/BruteForce"
    },
    {
      "name": "Trend Micro Security Research - HackTool.Win32.Bruteforce",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hacktool.win32.bruteforce"
    },
    {
      "name": "MITRE ATT&CK - Brute Force: Password Guessing (T1110.001)",
      "url": "https://attack.mitre.org/techniques/T1110/001/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}