Procedure examples

Pony has used a small dictionary of common passwords against a collected list of local accounts.

Emotet has been observed using a hard coded list of passwords to brute force user accounts.

P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.

Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.

China Chopper's server component can perform brute force password guessing against authentication portals.

Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.

SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.

HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.