Techniques › T1201
T1201 Password Policy Discovery
discovery — Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite · attack.mitre.org · JSON
1
MITRE detection strategy
7
analytics
6
Sigma rules tagged attack.t1201
0
KEV CVEs mapped here
<p>Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).</p><p>Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy</code>, <code>chage -l <username></code>, <code>cat /etc/pam.d/common-password</code>, and <code>pwpolicy getaccountpolicies</code>. Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. <code>show aaa</code>, <code>show aaa common-criteria policy all</code>).</p><p>Password policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy</code> in AWS.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0161 Password Policy Discovery – cross-platform behavior-chain analytics v1.0
AN0455 WindowsCause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g.,
net accounts,Get-ADDefaultDomainPasswordPolicy,secedit /export); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.Tunable:TimeWindowPrivilegedUserAllowListHostRoleScopePS_ScriptBlockPatternsAN0456 LinuxChain: (1) interactive/non-interactivechage -l,grep/catof PAM config (e.g.,/etc/pam.d/common-password,/etc/security/pwquality.conf); (2) optional reads of/etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditdexecveand file read events plus shell history collection.Tunable:MonitoredPathsServiceAccountsExcludeTerminalTypeAN0457 macOSChain: (1) execution ofpwpolicyor MDM/DirectoryService reads of account policies; (2) optional read of/Library/Preferences/com.apple.loginwindowor config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.Tunable:MDMProfileIDsAdminConsoleHostsAN0458 IaaSChain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWSGetAccountPasswordPolicy, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.Tunable:CloudReadOnlyAppsApiClientIPAllowListAN0459 Identity ProviderChain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.azure:auditoperation contains 'Get*Password*Policy' OR 'List*Authentication*Policy' OR 'Get-ADDefaultDomainPasswordPolicy'→ DC0013 User Account MetadataTunable:TrustedPartnerAppIdsGeoRiskToleranceAN0460 SaaSChain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ withGet-MsolPasswordPolicy/Get-OrganizationConfigparameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.m365:unifiedWorkload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))→ DC0013 User Account MetadataTunable:SaaSAdminGroupSessionAnomalyThresholdAN0461 Network DevicesChain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g.,show aaa,show password-policy); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.networkdevice:syslogcmd='show aaa*' OR 'show running-config | include password|aaa' OR 'show aaa common-criteria policy all'→ DC0064 Command ExecutionTunable:ApprovedNOCSourcesDeviceTier
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1201
Author: Zach Mathis
· 2023-05-19 · logsource: product=windows service=security · 12ba6a38-adb3-4d6b-91ba-a7fb248e3199
Detects when the password policy is enumerated.
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
· 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Detects execution of "Net.EXE".
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: frack113
· 2022-03-17 · logsource: product=windows category=ps_script · bbb9495b-58fc-4016-b9df-9a3a1b67ca82
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
Author: Ömer Günal, oscd.community, Pawel Mazur
· 2020-10-08 (modified 2024-12-01) · logsource: product=linux service=auditd · ca94a6db-8106-4737-9ed2-3e3bb826af0a
Detects password policy discovery commands