Cross-source coverage

T1201 / ATT&CK

Password Policy Discovery

42 rules · 40 families across 9 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies. Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS.

Tactics
Discovery
Platforms
Windows · Linux · macOS · IaaS · Network Devices · Identity Provider · SaaS · Office Suite
Telemetry
WinEventLog:SysmonWinEventLog:PowerShellWinEventLog:Securityauditd:SYSCALLlinux:syslogmacos:unifiedlogmacos:MDMAWS:CloudTrailazure:auditm365:unifiednetworkdevice:syslog

How MITRE says to detect it DET0161

Password Policy Discovery – cross-platform behavior-chain analytics

Windows Analytic 0455

Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g., `net accounts`, `Get-ADDefaultDomainPasswordPolicy`, `secedit /export`); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Security EventCode=4662

Linux Analytic 0456

Chain: (1) interactive/non-interactive `chage -l`, `grep`/`cat` of PAM config (e.g., `/etc/pam.d/common-password`, `/etc/security/pwquality.conf`); (2) optional reads of `/etc/login.defs`; (3) same user performs account enumeration or password change attempts shortly after. Use auditd `execve` and file read events plus shell history collection.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open,openat,read
  • linux:syslog sudo chage|grep pam_pwquality|cat /etc/login.defs

macOS Analytic 0457

Chain: (1) execution of `pwpolicy` or MDM/DirectoryService reads of account policies; (2) optional read of `/Library/Preferences/com.apple.loginwindow` or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.

  • macos:unifiedlog pwpolicy|PasswordPolicy
  • macos:unifiedlog exec /usr/bin/pwpolicy
  • macos:MDM profiles -P|getaccountpolicies

IaaS Analytic 0458

Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWS `GetAccountPasswordPolicy`, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.

  • AWS:CloudTrail GetAccountPasswordPolicy

Identity Provider Analytic 0459

Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.

  • azure:audit operation contains 'Get*Password*Policy' OR 'List*Authentication*Policy' OR 'Get-ADDefaultDomainPasswordPolicy'

SaaS Analytic 0460

Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ with `Get-MsolPasswordPolicy`/`Get-OrganizationConfig` parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.

  • m365:unified Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))

Network Devices Analytic 0461

Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g., `show aaa`, `show password-policy`); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.

  • networkdevice:syslog cmd='show aaa*' OR 'show running-config | include password|aaa' OR 'show aaa common-criteria policy all'

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 42 above — a rule tagged a sub-technique covers this technique too.

socfortress/Wazuh-Rules

14 rules · 12 families
Detection Severity Format
Detects password policy discovery commands. 2 variants High Wazuh XML
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. 2 variants High Wazuh XML
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · net.exe domain password policy (T1201) High Wazuh XML
Sysmon - Event 1: Process creation · net.exe local password policy (T1201) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Get-ADDefaultDomainPasswordPolicy (T1201) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Get-DomainPolicy (PowerView) (T1201) High Wazuh XML
Sysmon - Event 1: Process creation · secedit.exe export security policy (T1201) High Wazuh XML
Access to password complexity policy file detected (/etc/pam.d/common-password) Medium Wazuh XML
Access to password expiration policy file /etc/login.defs Medium Wazuh XML

+ 4 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

9 rules
Detection Severity Format
AWS High Number Of Failed Authentications For User Undefined SPL
AWS Password Policy Changes Undefined SPL
Get ADDefaultDomainPasswordPolicy with Powershell Undefined SPL
Get ADDefaultDomainPasswordPolicy with Powershell Script Block Undefined SPL
Get ADUserResultantPasswordPolicy with Powershell Undefined SPL
Get ADUserResultantPasswordPolicy with Powershell Script Block Undefined SPL
Get DomainPolicy with Powershell Undefined SPL
Get DomainPolicy with Powershell Script Block Undefined SPL
Windows Password Policy Discovery with Net Undefined SPL

SigmaHQ/sigma

6 rules
Detection Severity Format
HackTool - CrackMapExec Execution High Sigma
Password Policy Enumerated Medium Sigma
Cisco Discovery Low Sigma
Net.EXE Execution Low Sigma
Password Policy Discovery - Linux Low Sigma
Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy Low Sigma

Bert-JanP/Hunting-Queries-Detection-Rules

3 rules
Detection Severity Format
Detect net(1).exe Discovery Activities Undefined KQL
List net(1).exe discovery activities Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

elastic/detection-rules

3 rules
Detection Severity Format
Entra ID Sign-in BloodHound Suite User-Agent Detected High Elastic TOML
Entra ID Sign-in TeamFiltration User-Agent Detected High Elastic TOML
PowerShell Suspicious Discovery Related Windows API Functions Low Elastic TOML

panther-labs/panther-analysis

3 rules
Detection Severity Format
ZIA Password Expiration Medium Panther Python
AWS CloudTrail Password Policy Discovery Informational Panther Python
EKS Audit Log Reporting system Namespace is Used From A Public IP Informational Panther Python

elastic/protections-artifacts

2 rules
Detection Severity Format
Domain Password Policy Enumeration via LDAP Undefined Elastic TOML
Password Spraying Enumeration via LDAP Undefined Elastic TOML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Suspicious enumeration using Adfind tool (Normalized Process Events) Undefined KQL

chronicle/detection-rules

1 rule
Detection Severity Format
aws_password_policy_change Medium YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.