{
  "technique_id": "T1110",
  "mappings": [
    {
      "attack_technique": "T1110 Brute Force",
      "d3fend_technique": "Connection Attempt Analysis",
      "soc_action": "Review failed sign-in bursts, password spray patterns across many accounts from a small set of sources, and any success immediately following a failure streak.\n",
      "tooling": [
        "Sentinel",
        "Entra ID",
        "Defender XDR"
      ]
    },
    {
      "attack_technique": "T1110 Brute Force",
      "d3fend_technique": "Strong Password Policy",
      "soc_action": "Confirm lockout thresholds, smart lockout, and banned-password lists are enforced; tighten where legacy or service accounts are exempt.\n",
      "tooling": [
        "Entra ID",
        "Group Policy"
      ]
    },
    {
      "attack_technique": "T1110 Brute Force",
      "d3fend_technique": "Multi-factor Authentication",
      "soc_action": "Confirm MFA is enforced for the affected account and that legacy authentication protocols (which bypass MFA) are blocked.\n",
      "tooling": [
        "Entra ID Conditional Access"
      ]
    },
    {
      "attack_technique": "T1110 Brute Force",
      "d3fend_technique": "Credential Revocation",
      "soc_action": "Revoke sessions and refresh tokens if a spray attempt succeeded.",
      "tooling": [
        "Microsoft Graph",
        "Entra ID"
      ]
    }
  ]
}