Home/ MITRE Matrix/ Credential Access/ T1110.001

T1110.001Password Guessing

T1110.001 — Password Guessing is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 16 detection use cases covering it and 4 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

16Use cases

4Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1110 · Brute Force

Use cases covering this technique (16)

Cisco ASA - User Account Lockout Threshold Exceeded ESCU actions · hunting P ASL AWS Credential Access GetPasswordData ESCU actions · hunting P AWS Credential Access Failed Login ESCU actions · alerting P AWS Credential Access GetPasswordData ESCU actions · hunting P Azure AD High Number Of Failed Authentications For User ESCU actions · alerting P Azure AD High Number Of Failed Authentications From Ip ESCU actions · alerting P Azure AD Successful Authentication From Different Ips ESCU actions · alerting P High Number of Login Failures from a single source ESCU actions · hunting P O365 High Number Of Failed Authentications for User ESCU actions · alerting P Windows Remote Desktop Network Bruteforce Attempt ESCU actions · hunting P CrushFTP Max Simultaneous Users From IP ESCU actions · hunting P Remote Desktop Network Bruteforce ESCU actions · alerting P [LLM] PeopleSoft lateral-movement script — *_fanout.sh execution and zstd compression chain Bespoke actions · hunting DSΣPDDCS [LLM] FortiGate SSL-VPN / admin credential brute-force or spray from single source Bespoke delivery · alerting DSPDD [LLM] phpMyFAQ /admin/check unauthenticated TOTP brute-force (CVE GHSA-9pq7-mfwh-xx2j) Bespoke exploit · alerting SP [LLM] Strapi boolean-oracle hex-alphabet brute force from single source Bespoke exploit · alerting SPDD

Articles citing this technique (4)

crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities art-37

high AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. art-51

crit [GHSA / CRITICAL] GHSA-6626-79jh-5ccr: Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptan art-280

crit [GHSA / CRITICAL] CVE-2026-27886: Strapi may leak sensitive data via relational filtering due to lack of query sanitization art-305