aol.pm

Password Guessing

Subtechnique · ATTACK:enterprise:T1110.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1110.001",
  "title": "Password Guessing",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1110/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119",
  "external_id": "T1110.001",
  "domain": "enterprise",
  "created": "2020-02-11T18:38:22.617Z",
  "modified": "2026-05-12T15:12:00.620Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Trend Micro Emotet 2020",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/emotet-now-spreads-via-wi-fi"
    },
    {
      "source_name": "Cylance Cleaver",
      "url": "https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
    },
    {
      "source_name": "US-CERT TA18-068A 2018",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-086A"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--046d418d-ffcc-4939-87ce-09cfc2885a5a

FireEye Periscope March 2018

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--070de14a-70df-4935-ba26-56a14282ae52

Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c76bb94-1a6e-4ec6-9faa-2b444d80002c

Binary Defense Emotes Wi-Fi Spreader · CIS Emotet Dec 2018 · Secureworks Emotet Nov 2018 · Malwarebytes Emotet Dec 2017 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27e3d3fc-fdd5-48f3-98aa-6b374ff98ed1

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3222edc5-bed6-4e8f-b62b-d76040754218

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b8bdc58-cfb9-4841-94e9-421b9e08f44f

Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5348c284-b5c7-4b30-a528-a9b0002ac8b9

CME Github September 2018

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fad18cd-28b4-47b4-8b38-f8beaf1120ad

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--801fa89f-8114-492f-9748-85187190ea86

ESET Hermetic Wizard March 2022

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b88b63a-c415-4218-b579-6a10de86b6eb

NIST 800-63-3

ATTACK:enterprise:M1036 → mitigates → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f2d973c-aa06-42a1-9490-1e799c0a5ee2

Microsoft Common Conditional Access Policies · Okta Block Anonymizing Services

ATTACK:enterprise:T1110.001 → subtechnique-of → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9529dc44-9a72-49b7-bfea-713356b0f55a

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac1597ea-c0da-4365-998e-25e8e1ee87c9

Mandiant APT29 Microsoft 365 2022

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7e456b1-ed5e-48f0-be6e-df3e7d6b4044

Unit 42 Lucifer June 2020

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c83116c0-b720-4efb-a074-f61e085ae30a

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd8d683a-0c17-448f-b604-105e130f4b04

Malwarebytes Pony April 2016

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9de3c2d-1b2e-4c35-a406-475f5f5fd4d5

Unit42 Xbash Sept 2018 · Trend Micro Xbash Sept 2018

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1110.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed00df58-4656-4c62-8ef1-8b859f46c1ed

ANSSI Sandworm January 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.