Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or password hashes are obtained.

• Account lockout policies
• Multi-factor authentication
• Strong password requirements
• Rate limiting

• Monitor failed login attempts
• Detect password spray patterns
• Track unusual authentication volume