Techniques › T1201 › AN0456
AN0456 Analytic 0456
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Chain: (1) interactive/non-interactive
chage -l, grep/cat of PAM config (e.g., /etc/pam.d/common-password, /etc/security/pwquality.conf); (2) optional reads of /etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditd execve and file read events plus shell history collection.</p>- Detects
- T1201 Password Policy Discovery
- Part of
- DET0161 Password Policy Discovery – cross-platform behavior-chain analytics
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| auditd:SYSCALL | open,openat,read | DC0013 User Account Metadata |
| linux:syslog | sudo chage|grep pam_pwquality|cat /etc/login.defs | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredPaths | Exact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ). |
ServiceAccountsExclude | System daemons that legitimately parse policies on boot. |
TerminalType | TTY vs. non-interactive—raise risk for non-interactive remote execution. |