Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1110.002sub-technique of T1110 Brute Force

Password Cracking

Identity Provider · Linux · macOS · Network Devices · Office Suite · Windowsnothing on this site yetT1110.002 on attack.mitre.org

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools

  • Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files
  • Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes
  • Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login
  • Sudden valid logins from accounts that previously had credentials dumped but had not authenticated successfully in the past; correlated with timeline of suspected hash cracking

what reduces it

  • M1027 Password Policies. Refer to NIST guidelines when creating password policies.
  • M1032 Multi-factor Authentication. Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.

the rest of T1110

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.