kevmap

TechniquesT1201 › AN0456

AN0456 Analytic 0456

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Chain: (1) interactive/non-interactive chage -l, grep/cat of PAM config (e.g., /etc/pam.d/common-password, /etc/security/pwquality.conf); (2) optional reads of /etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditd execve and file read events plus shell history collection.</p>
Detects
T1201 Password Policy Discovery
Part of
DET0161 Password Policy Discovery – cross-platform behavior-chain analytics

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLexecveDC0032 Process Creation
auditd:SYSCALLopen,openat,readDC0013 User Account Metadata
linux:syslogsudo chage|grep pam_pwquality|cat /etc/login.defsDC0064 Command Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
MonitoredPathsExact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ).
ServiceAccountsExcludeSystem daemons that legitimately parse policies on boot.
TerminalTypeTTY vs. non-interactive—raise risk for non-interactive remote execution.