{"id":"T1201","name":"Password Policy Discovery","url":"https://attack.mitre.org/techniques/T1201","tactics":["discovery"],"platforms":["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0161","stix_id":"x-mitre-detection-strategy--72742281-7457-4124-a277-7f3cf5e23f4e","name":"Password Policy Discovery – cross-platform behavior-chain analytics","url":"https://attack.mitre.org/detectionstrategies/DET0161","analytics":[{"id":"AN0455","stix_id":"x-mitre-analytic--ae82099a-0baf-4887-953c-67ef5e2d4470","name":"Analytic 0455","description":"Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g., `net accounts`, `Get-ADDefaultDomainPasswordPolicy`, `secedit /export`); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0455","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Security","channel":"EventCode=4662","data_component":"DC0071","data_component_name":"Active Directory Object Access","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between policy query and adjacent suspicious activity (e.g., 15–30 minutes)."},{"field":"PrivilegedUserAllowList","description":"Accounts (e.g., Helpdesk) allowed to run policy queries routinely."},{"field":"HostRoleScope","description":"Limit alerts on DCs/management servers; raise on user workstations/VDI."},{"field":"PS_ScriptBlockPatterns","description":"Cmdlet/function names to treat as high-signal in your environment."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0456","stix_id":"x-mitre-analytic--bcf6e9cb-fee9-4efd-8998-03de4908448b","name":"Analytic 0456","description":"Chain: (1) interactive/non-interactive `chage -l`, `grep`/`cat` of PAM config (e.g., `/etc/pam.d/common-password`, `/etc/security/pwquality.conf`); (2) optional reads of `/etc/login.defs`; (3) same user performs account enumeration or password change attempts shortly after. Use auditd `execve` and file read events plus shell history collection.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0456","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open,openat,read","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"sudo chage|grep pam_pwquality|cat /etc/login.defs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"MonitoredPaths","description":"Exact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ)."},{"field":"ServiceAccountsExclude","description":"System daemons that legitimately parse policies on boot."},{"field":"TerminalType","description":"TTY vs. non-interactive—raise risk for non-interactive remote execution."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0457","stix_id":"x-mitre-analytic--4f71c7bd-dd25-43c7-ac5c-7a85c7588759","name":"Analytic 0457","description":"Chain: (1) execution of `pwpolicy` or MDM/DirectoryService reads of account policies; (2) optional read of `/Library/Preferences/com.apple.loginwindow` or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0457","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"pwpolicy|PasswordPolicy","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"exec /usr/bin/pwpolicy","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:MDM","channel":"profiles -P|getaccountpolicies","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"macos-mdm"}],"mutable_elements":[{"field":"MDMProfileIDs","description":"Approved profiles reading/updating auth policies."},{"field":"AdminConsoleHosts","description":"Jamf or management hosts where queries are expected."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0458","stix_id":"x-mitre-analytic--12f9a28b-126d-48b1-bc93-5bc3c1635905","name":"Analytic 0458","description":"Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWS `GetAccountPasswordPolicy`, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0458","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"GetAccountPasswordPolicy","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"CloudReadOnlyApps","description":"Approved security tooling principals that routinely read policy."},{"field":"ApiClientIPAllowList","description":"Corporate egress IPs for administrative API access."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0459","stix_id":"x-mitre-analytic--0b0d50a0-d07b-4cf1-9cb0-23c95e8321b2","name":"Analytic 0459","description":"Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0459","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:audit","channel":"operation contains 'Get*Password*Policy' OR 'List*Authentication*Policy' OR 'Get-ADDefaultDomainPasswordPolicy'","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"azure-audit"}],"mutable_elements":[{"field":"TrustedPartnerAppIds","description":"Legitimate partner apps that enumerate policies."},{"field":"GeoRiskTolerance","description":"Raise risk for unusual geo or TOR/VPN egress."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0460","stix_id":"x-mitre-analytic--d71a1e3e-6507-438b-9ee2-f80dc1f938d2","name":"Analytic 0460","description":"Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ with `Get-MsolPasswordPolicy`/`Get-OrganizationConfig` parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0460","platforms":["SaaS"],"log_source_references":[{"name":"m365:unified","channel":"Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"SaaSAdminGroup","description":"Known admin groups or break-glass accounts."},{"field":"SessionAnomalyThreshold","description":"Rate/volume of read operations per session considered anomalous."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]},{"id":"AN0461","stix_id":"x-mitre-analytic--d93312e3-210a-4757-b638-4ed19fca8621","name":"Analytic 0461","description":"Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g., `show aaa`, `show password-policy`); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0461","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"cmd='show aaa*' OR 'show running-config | include password|aaa' OR 'show aaa common-criteria policy all'","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"ApprovedNOCSources","description":"Jump hosts permitted to run show commands."},{"field":"DeviceTier","description":"Higher risk weight on edge/critical devices."}],"live":true,"detection_strategies":["DET0161"],"techniques":["T1201"]}],"live":true,"version":"1.0","techniques":["T1201"]}],"sigma_rules":[{"id":"12ba6a38-adb3-4d6b-91ba-a7fb248e3199","title":"Password Policy Enumerated","author":"Zach Mathis","status":"test","level":"medium","date":"2023-05-19","modified":null,"description":"Detects when the password policy is enumerated.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661","https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1201"],"path":"rules/windows/builtin/security/win_security_password_policy_enumerated.yml","techniques":["T1201"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-03-08","description":"This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.","references":["https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local","https://www.mandiant.com/resources/telegram-malware-iranian-espionage","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.discovery","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.t1110","attack.t1201"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","techniques":["T1047","T1053","T1059.003","T1059.001","T1110","T1201"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"bbb9495b-58fc-4016-b9df-9a3a1b67ca82","title":"Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":null,"description":"Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy","https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1201"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml","techniques":["T1201"],"cves":[]},{"id":"ca94a6db-8106-4737-9ed2-3e3bb826af0a","title":"Password Policy Discovery - Linux","author":"Ömer Günal, oscd.community, Pawel Mazur","status":"stable","level":"low","date":"2020-10-08","modified":"2024-12-01","description":"Detects password policy discovery commands","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md","https://linux.die.net/man/1/chage","https://man7.org/linux/man-pages/man1/passwd.1.html","https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1201"],"path":"rules/linux/auditd/lnx_auditd_password_policy_discovery.yml","techniques":["T1201"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}