Brute-force attack
A brute-force attack uses repeated candidate credentials or secret values to try to find one that a system accepts, or to recover a secret from captured data.
A broad name for repeated attempts
In everyday incident reports, brute force often means trying many passwords against an account. MITRE uses a broader category that includes password guessing, password cracking, password spraying, and credential stuffing. Naming the particular behavior makes a finding easier to act on.
Spraying spreads a small set of guesses across accounts. Stuffing uses stolen pairs rather than guessing each password from scratch. These patterns can call for different searches even though both involve attempts to authenticate.
Online and offline attacks need different controls
An online attempt reaches a service that can reject or limit it. Rate limiting and MFA can restrict what repeated password attempts accomplish. An offline attack works against captured material, such as password hashes, without asking the live sign-in service to approve each guess. A login lockout cannot slow that offline computation.
NIST’s authentication guidance addresses both sides: limits on failed authentication attempts, and salted password hashing designed to resist offline attacks. A hash is a derived value used to verify a password; it should not be a recoverable copy of the password.
An alert about online guessing belongs in a sign-in investigation. Evidence of stolen password hashes also calls for assessing the exposed credential store. The sign-in evidence article covers the first case.