T1201: Password Policy Discovery
Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies . Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS .
Positive Technologies products that cover the technique
MaxPatrol SIEM knowledge base
unix_mitre_attck_discovery: PT-CR-1789: Unix_MsLDAPDump_Usage: Attackers can download information from AD and use it to progress the attack unix_mitre_attck_discovery: PT-CR-1680: Unix_Password_Policy_Discovery: Information about local password policy on a Unix host was received unix_mitre_attck_discovery: PT-CR-480: Unix_Local_Mass_Recon: A large number of reconnaissance commands were executed. Possible automated reconnaissance. mitre_attck_discovery: PT-CR-324: Password_Policy_Discovery: An attempt to access detailed information about a corporate network password policy. Based on this information, an attacker can create a special password list and launch a dictionary or brute-force attack mitre_attck_discovery: PT-CR-2117: Windows_Mass_Recon: Large number of reconnaissance-related actions on a host mitre_attck_discovery: PT-CR-1083: Ldapdomaindump_Queries: Active Directory information is dumped using ldapdomaindump
Detection
| ID | DS0002 | Data source and component | User Account: User Account Metadata | Description | Monitor for contextual data about an account that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. |
|---|
| ID | DS0017 | Data source and component | Command: Command Execution | Description | Monitor executed commands and arguments for actions that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. For network devices, monitor executed commands in AAA logs, especially those run by unexpected or unauthorized users. |
|---|
| ID | DS0009 | Data source and component | Process: Process Creation | Description | Monitor for newly executed processes that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. |
|---|
Mitigation
| ID | M1027 | Name | Password Policies | Description | Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (
|
|---|