Praetorian Brutus: Open-Source Multi-Protocol Credential Testing Engine Expands to 14 New Protocols with People Enumeration and Credential Persistence

Key facts for Brutus credential testing tool

Detection coverage for Brutus credential testing tool

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5355 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Brutus-Style Multi-Protocol Authentication Failure Burst from Single Source

TL-2026-5355: Detects one source generating a burst of authentication failures across several applications and destinations within 10 minutes, the behavioural signature of Praetorian Brutus (and THC Hydra) credential testing against brokers, caches, databases, SSH/RDP and other services (T1110.001 password guessing, T1110.003 spraying, T1110.004 stuffing). Behaviour-first: it does not depend on the tool binary and also fires through rotating SOCKS5 proxies when pool members are individually noisy. Requires the CIM Authentication data model to be populated and accelerated.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110, T1110.001, T1110.003, T1110.004
• Data sources: splunk_cim_authentication, windows_security_4625, linux_syslog_sshd
• Severity: medium
• Confidence: medium

Splunk SPL

| tstats summariesonly=true count AS failures dc(Authentication.app) AS app_count dc(Authentication.dest) AS dest_count dc(Authentication.user) AS user_count values(Authentication.app) AS apps from datamodel=Authentication where Authentication.action=failure by Authentication.src _time span=10m
| rename Authentication.src AS src
| where failures>=30 AND app_count>=3 AND dest_count>=3
| eval technique="T1110.003", tool_family="Brutus/Hydra-style credential testing"
| table _time src failures app_count dest_count user_count apps technique tool_family

Microsoft KQL

let win = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| where isnotempty(IpAddress) and IpAddress !in ('-', '::1', '127.0.0.1')
| project TimeGenerated, SrcIp = IpAddress, Dest = Computer, Svc = 'windows_logon', User = TargetUserName;
let ssh = Syslog
| where TimeGenerated > ago(24h)
| where ProcessName == 'sshd' and SyslogMessage has 'Failed password'
| extend SrcIp = extract(@'from (\d{1,3}(?:\.\d{1,3}){3})', 1, SyslogMessage)
| where isnotempty(SrcIp)
| project TimeGenerated, SrcIp, Dest = Computer, Svc = 'ssh', User = extract(@'for (?:invalid user )?(\S+) from', 1, SyslogMessage);
union win, ssh
| summarize Failures = count(), Services = dcount(Svc), Destinations = dcount(Dest), Users = dcount(User) by SrcIp, bin(TimeGenerated, 10m)
| where Failures >= 30 and Destinations >= 3
| project TimeGenerated, SrcIp, Failures, Services, Destinations, Users

Sigma

title: Brutus-Style SSH Password Guessing Failures
id: 6f1c2a9e-3b7d-4e58-9a41-0c5d8e2b7f10
status: experimental
description: Detects failed SSH password and invalid-user authentication entries that Brutus or THC Hydra style credential testing produces (TL-2026-5355). Sigma cannot express thresholds in a single rule; apply a backend correlation of 30 or more matches from one source within 10 minutes across 3 or more hosts.
references:
  - https://www.praetorian.com/blog/credential-testing-brutus/
  - https://github.com/praetorian-inc/brutus
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.credential_access
  - attack.t1110.001
  - attack.t1110.003
  - attack.t1110.004
logsource:
  product: linux
  service: sshd
detection:
  keywords:
    - 'Failed password for'
    - 'Invalid user'
    - 'authentication failure'
  condition: keywords
falsepositives:
  - Users mistyping passwords
  - Authorized vulnerability scanners and penetration tests
level: medium

Known false positives:

• Authorized penetration tests or red-team credential testing using Brutus or Hydra
• Misconfigured service accounts or monitoring agents repeatedly failing against many hosts
• Shared NAT egress addresses aggregating many users' failures

Tuning notes: Tune failures/app_count/dest_count thresholds to your baseline, allowlist scanner and jump-host sources, and enrich src with known NAT ranges. Rotating proxy pools lower per-source counts; consider also aggregating by target account or destination.

• 🔒 Credential Testing Burst Followed by Successful Logon from Same Source · unlock with TL Creds
• 🔒 Entra ID / M365 User-Existence Enumeration Burst ([indicator] M365 Enum) · unlock with TL Creds
• 🔒 Non-Browser Access to People-Intelligence and Enumeration Services ([indicator] Connectors) · unlock with TL Creds
• 🔒 [indicator], Hydra and Recon-Pipeline Tool Execution · unlock with TL Creds
• 🔒 Accessibility Binary Image File Execution Options Debugger (Logon-Screen Backdoor) · unlock with TL Creds
• 🔒 Probing of Broker, Cache, ICS and IPMI Service Ports from One Source ([indicator] 14-Protocol Sweep) · unlock with TL Creds
• 🔒 Sticky Keys / Utilman Logon-Screen Backdoor via Replaced Accessibility Binary · unlock with TL Creds
• 🔒 RDP Logon-Screen Probe Sweep ([indicator] logon, Non-NLA) · unlock with TL Creds

Indicators of compromise for Brutus credential testing tool

As of 2026-11-05, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5355.

Sample indicators (3 of 16)

• Domain: apollo[.]io
• Domain: linkedin[.]com
• Domain: phantombuster[.]com

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How Brutus credential testing tool works

It is dual-use offensive tooling with no CVEs, no attributed threat actor and no reported in-the-wild abuse.

Brutus is a single-binary, zero-external-dependency credential testing tool written in Go and published by Praetorian at github.com/praetorian-inc/brutus under the Apache-2.0 license. It was introduced on 2026-02-13 (Praetorian blog 'Et Tu, Default Creds?', a Praetorian DEV Community post the same day, and Help Net Security coverage) as a modern replacement for legacy brute-forcers such as THC Hydra. The initial release covered about 22-23 protocols (SSH, FTP, Telnet, VNC, SNMP, HTTP/HTTPS, SMB, LDAP, WinRM, MySQL, PostgreSQL, MSSQL, MongoDB, Redis, Neo4j, Cassandra, CouchDB, Elasticsearch, InfluxDB, SMTP, IMAP, POP3), embedded known-bad SSH key collections (Rapid7 ssh-badkeys, HashiCorp Vagrant, F5, ExaGrid and other vendor appliance keys with CVE metadata), JSON-streaming pipeline integration with reconnaissance tools (Nerva, naabu, fingerprintx, nmap/masscan output), and experimental AI features: LLM-suggested default credentials from HTTP responses and headless-Chrome login automation using Claude's vision API.

Praetorian's 2026-09-17 blog post 'Credentials Are Still the Shortest Path In' (byline Unit-O1; Brutus is described as a component of the Praetorian Guard platform) describes the update. Brutus now finds identities attached to an organization, tests them across services, and carries confirmed credentials into future runs ('credentials confirmed during a hunt are persisted and handed to the re-verification pass' across tenant services, enabling automatic password-reuse detection). The update adds 14 protocols: messaging/queuing (AMQP, MQTT, Kafka, NATS, ActiveMQ, XMPP, SIP), data/caching (Memcached, Firebird, DB2, ZooKeeper) and industrial/infrastructure (OPC UA, IPMI, SOCKS5). People enumeration uses an Apollo.io connector (split discover and enrich flow) and a LinkedIn Sales Navigator connector; generated usernames now carry first and last names. Microsoft 365 enumeration is a standalone command, GitHub email enumeration has an improved CSRF session handshake, and rotating proxies are supported across active enumeration modes. PostgreSQL plugin fixes cover TLS mode, special characters/spaces in credentials and IPv6 hosts.

The GitHub release history shows the update was delivered incrementally between July and September 2026: v1.8.2 (2026-07-08) added Microsoft 365 batching with a worker pool; v1.9.0 (2026-07-09) added LinkedIn Sales Navigator via PhantomBuster and the standalone Microsoft 365 enumeration command; v1.10.0 (2026-07-22) added PostgreSQL TLS, GitHub rotating-proxy fixes, a Gravatar oracle and Dehashed database selection; v1.11.0-v1.13.0 (2026-08-12 to 2026-08-18) added generated-name support across all enumeration oracles and a shared TargetWorker; v1.14.0-v1.14.2 (2026-08-19 to 2026-08-20) added a reusable reveal repository for GitHub enumeration, a commit-walk pagination fix, and stopped the Apollo connector requesting personal email addresses on people/match; v1.15.0 (2026-09-09) added logon-screen detection library, RDP session handling improvements and CLI surface drift detection. The project README lists 43 protocols and subcommands such as creds, web, badkeys, enum, logon (RDP backdoor detection) and snmp, aggressiveness modes (cautious/default/aggressive), SOCKS5 proxy routing (--proxy socks5://host:port) and an --experimental-ai flag.

The logon capability detects accessibility-tool backdoors (sethc.exe 'sticky keys', Utilman.exe replaced with a SYSTEM shell) at the Windows logon screen by connecting over non-NLA RDP and comparing against a baseline screenshot, pre-authentication and without credentials or system modification. This is the classic T1546.008 persistence technique, here used as a detection primitive by assessors; defenders should expect the same technique to be hunted by adversaries.

The source material lists no CVEs, IOCs, in-the-wild exploitation, or threat-actor attribution. The defensive value is in understanding the attack surface the tool exercises: default or reused credentials on message brokers, caches, databases, ICS-adjacent services (OPC UA), BMC/IPMI interfaces, SIP and SOCKS5 proxies, and externally enumerable identities (M365 tenant user existence, GitHub commit emails, employee names from sales-intelligence platforms). Any open-source credential tool of this kind can be misused by criminal actors, so detection should focus on behavior (multi-protocol authentication failure bursts from one source, M365 user enumeration, GitHub email scraping, non-NLA RDP logon-screen probes) rather than the tool binary alone.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services: SSH

Discovery

T1046 Network Service Discovery

Initial Access

T1078 Valid Accounts

Command and Control

T1090 Proxy

Credential Access

T1110 Brute Force; T1110.001 Brute Force: Password Guessing; T1110.003 Brute Force: Password Spraying; T1110.004 Brute Force: Credential Stuffing

Persistence

T1546.008 Event Triggered Execution: Accessibility Features

Resource Development

T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1589.001 Gather Victim Identity Information: Credentials; T1589.002 Gather Victim Identity Information: Email Addresses; T1589.003 Gather Victim Identity Information: Employee Names; T1591.004 Gather Victim Org Information: Identify Roles

Remediation for Brutus credential testing tool

Immediate actions

• Change default and vendor-shipped credentials on message brokers (AMQP/RabbitMQ, MQTT, Kafka, NATS, ActiveMQ), caches (Memcached, Redis), databases (DB2, Firebird, PostgreSQL, MySQL, MSSQL), ZooKeeper, SIP, IPMI/BMC, OPC UA and SOCKS5 services
• Remove or firewall internet exposure of broker, cache, database, IPMI, OPC UA and ZooKeeper management ports
• Rotate any credential known or suspected to be reused across services or tenants

Workarounds

• Block IPMI (UDP 623) and OPC UA exposure at the perimeter
• Enable account lockout or throttling on supported services
• Restrict broker and cache listeners to management networks

Longer-term hardening

• Enforce unique per-service credentials with a secrets manager and phishing-resistant MFA on identity providers
• Alert on authentication-failure bursts spanning multiple protocols from a single source or rotating proxy pool
• Limit M365 and GitHub user-enumeration exposure (tenant hardening, disable public commit-email exposure, use noreply addresses)
• Require NLA for RDP and monitor sethc.exe/Utilman.exe integrity

Affected and fixed versions

• Various — Network services exposed with weak, default or reused credentials (AMQP, MQTT, Kafka, NATS, ActiveMQ, XMPP, SIP, Memcached, Firebird, DB2, ZooKeeper, OPC UA, IPMI, SOCKS5, SSH, RDP, SMB, LDAP, WinRM, common databases)
  Vulnerable versions: Any deployment using default, weak or reused credentials
  Fixed in: Unique strong credentials with MFA and exposure reduction
• Microsoft — Microsoft 365 / Entra ID tenants (user existence enumeration target)
  Vulnerable versions: Tenants permitting account-existence oracles
• GitHub — GitHub accounts (email enumeration target)
  Vulnerable versions: Accounts exposing commit emails

Timeline of Brutus credential testing tool

• 2026-02-13 Help Net Security and a locked-ioc-9 DEV Community post cover the locked-ioc-13 release, noting Hydra replacement positioning, pipeline integration with locked-ioc-15/locked-ioc-7 and Linux, macOS and Windows support
• 2026-02-13 locked-ioc-9 publishes 'Et Tu, Default Creds?' introducing locked-ioc-13, an open-source Go credential testing tool with 22-23 initial protocols, embedded SSH bad keys and experimental Claude-vision browser automation
• 2026-07-08 locked-ioc-13 v1.8.2 adds Microsoft 365 enumeration batching with a worker pool and context cancellation fixes
• 2026-07-09 locked-ioc-13 v1.9.0 adds LinkedIn Sales Navigator people enumeration via PhantomBuster and a standalone Microsoft 365 enumeration command
• 2026-07-22 locked-ioc-13 v1.10.0 adds PostgreSQL TLS support, GitHub rotating-proxy fixes, a Gravatar enumeration oracle and Dehashed database selection
• 2026-08-12 locked-ioc-13 v1.11.0 adds target and name fields in results and generated-name support across all enumeration oracles
• 2026-08-19 locked-ioc-13 v1.14.0 adds a reusable reveal repository for GitHub email enumeration; v1.14.1 and v1.14.2 (2026-08-20) fix commit-walk pagination and stop the Apollo connector requesting personal emails
• 2026-09-09 locked-ioc-13 v1.15.0 adds a logon-screen detection library for locked-ioc-10/locked-ioc-8 backdoors, RDP session handling improvements and CLI surface drift detection
• 2026-09-17 14 protocols announced as added: AMQP, MQTT, Kafka, NATS, ActiveMQ, XMPP, SIP, Memcached, Firebird, DB2, ZooKeeper, OPC UA, IPMI and SOCKS5, alongside locked-ioc-11 people enumeration and rotating-proxy M365/GitHub enumeration
• 2026-09-17 locked-ioc-9 blog 'Credentials Are Still the Shortest Path In' describes the update: identity discovery, cross-service testing and carry-forward of confirmed credentials

Sources cited for Brutus credential testing tool

• Brutus: Modern Credential Attack Testing (Praetorian documentation) docs.praetorian.com · Vendor report
• praetorian-inc/brutus (GitHub repository) GitHub · Code repository
• praetorian-inc/brutus Releases (v1.8.2 - v1.15.0) GitHub · Code repository · 2026-09-09
• Credentials Are Still the Shortest Path In (Praetorian) praetorian.com · Blog · 2026-09-17
• Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing (Praetorian) praetorian.com · Blog · 2026-02-13
• We Replaced Our Bash Scripts and Hydra With a Single Go Binary for Credential Testing (DEV Community, Praetorian Guard) dev.to · Blog · 2026-02-13
• Brutus: Open-source credential testing tool for offensive security (Help Net Security) Help Net Security · News · 2026-02-13

More in threat intel

• ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)
• OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
• OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks
• Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)
• BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records