Password Policy Discovery `T1201`

Tactic: Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Events covered

12 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4661	A handle to an object was requested.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4799	A security-enabled local group membership was enumerated.
Defender-DeviceEvents	any	Defender event
Defender-DeviceEvents	LdapSearch	LDAP search
Defender-DeviceInfo	any	Device information
Defender-DeviceNetworkEvents	any	Network activity
Defender-DeviceNetworkInfo	any	Device network configuration
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1309	EXECVE
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 32 rules share fields, values, and exclusions.

Fields filtered most (41 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	8	`contains` 7, `regex_match` 1	`--local-auth`, `-H` , `-H 'NTHASH'`, `accounts`, `group`
`ScriptBlockText`	7	`contains` 4, `in` 3, `eq` 2	`Get-ADDefaultDomainPasswordPolicy`, `Get-ADUserResultantPasswordPolicy`, `Get-DomainPolicy`, `.GetGPOReport()`, `.MaxPasswordAge`
`EventID`	6	`eq` 6	`4104`, `4799`, `DeleteAccountPasswordPolicy`, `UpdateAccountPasswordPolicy`
`process_basename`	5	`eq` 5, `starts_with` 2	`cmd.exe`, `powershell*`, `LogonSessions.exe`, `PsGetSID.exe`, `PsLoggedOn.exe`
`OriginalFileName`	4	`eq` 4	`net1.exe`, `net.exe`, `Cmd.Exe`, `PowerShell.EXE`, `powershell_ise.EXE`
`event.category`	4	`eq` 4	`process`, `LOGIN`
`Image`	3	`ends_with` 3	`\net.exe`, `\net1.exe`, `\crackmapexec.exe`
`aws::eventName`	3	`in` 2, `eq` 1	`GetAccountPasswordPolicy`, `UpdateAccountPasswordPolicy`, `ConsoleLogin`, `DeleteAccountPasswordPolicy`, `PutAccountPasswordPolicy`
`ObjectServer`	2	`eq` 2	`Security Account Manager`
`aws::userAgent`	2	`eq` 1, `regex_match` 1	`(azure\|sharp\|blood)(hound)/.*`, `Mozilla/5.0 (Windows NT 10.0; Win64; x64)...`
`data_stream.dataset`	2	`eq` 1, `in` 1	`azure.activitylogs`, `azure.auditlogs`, `azure.graphactivitylogs`, `azure.signinlogs`, `o365.audit`
`process.Ext.api.name`	2	`eq` 2	`ldap_search`
`process.Ext.api.parameters.search_filter`	2	`wildcard` 2, `contains` 1	`(&(objectCategory=Computer)(!userAccountControl:1.2.840.1...`, `(&(objectCategory=person)(objectClass=user)(!(userAccount...`, `(&(objectCategory=person)(objectClass=user)(directReports...`, `(pwdlastset>=(operatingSystem=windows))`, `msDS-PasswordSettings`
`sourcetype`	2	`eq` 2	`aws:cloudtrail`
`user.id`	2	`ne` 2	`S-1-5-18`

Top indicator values (309 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventID`	`eq`	`4104` splunkGet ADDefaultDomainPasswordPolicy with Powershell Script Block splunkGet ADUserResultantPasswordPolicy with Powershell Script Block splunkGet DomainPolicy with Powershell Script Block splunkSharpHound Keywords (PowerShell)	4	269
`process_basename`	`eq`	`cmd.exe` elasticWindows Account or Group Discovery splunkGet ADDefaultDomainPasswordPolicy with Powershell splunkGet ADUserResultantPasswordPolicy with Powershell splunkGet DomainPolicy with Powershell	4	122
`process_basename`	`eq`	`net1.exe` elasticWindows Account or Group Discovery splunkWindows Password Policy Discovery with Net	2	40
`event.category`	`eq`	`process` elasticDeprecated - PowerShell Script with Discovery Capabilities elasticPowerShell Script with Password Policy Discovery Capabilities elasticPowerShell Suspicious Discovery Related Windows API Functions	3	105
`CommandLine`	`contains`	`accounts` sigmaPassword policy discovery via commandline splunkWindows Password Policy Discovery with Net	2	2
`CommandLine`	`contains`	`--local-auth` sigmaHackTool - CrackMapExec Execution	1
`CommandLine`	`contains`	`-H` sigmaHackTool - CrackMapExec Execution	1
`CommandLine`	`contains`	`-H 'NTHASH'` sigmaHackTool - CrackMapExec Execution	1
`CommandLine`	`contains`	`-M` sigmaHackTool - CrackMapExec Execution	1	2
`CommandLine`	`contains`	`-M pe_inject` sigmaHackTool - CrackMapExec Execution	1
`CommandLine`	`contains`	`-d` sigmaHackTool - CrackMapExec Execution	1	8
`CommandLine`	`contains`	`-o` sigmaHackTool - CrackMapExec Execution	1	4
`CommandLine`	`contains`	`-p` sigmaHackTool - CrackMapExec Execution	1	12
`CommandLine`	`contains`	`-u` sigmaHackTool - CrackMapExec Execution	1	6
`CommandLine`	`contains`	`-x` sigmaHackTool - CrackMapExec Execution	1	2
`CommandLine`	`contains`	`10.` sigmaHackTool - CrackMapExec Execution	1	3
`CommandLine`	`contains`	`192.168.` sigmaHackTool - CrackMapExec Execution	1	3
`CommandLine`	`contains`	`accounts` sigmaNet.EXE Execution	1
`CommandLine`	`contains`	`group` sigmaNet.EXE Execution	1	2
`Image`	`ends_with`	`\net.exe` sigmaNet.EXE Execution sigmaPassword policy discovery via commandline	2	49
`Image`	`ends_with`	`\net1.exe` sigmaNet.EXE Execution sigmaPassword policy discovery via commandline	2	47
`ObjectServer`	`eq`	`Security Account Manager` sigmaDomain password policy enumeration sigmaPassword Policy Enumerated	2	7
`OriginalFileName`	`eq`	`net1.exe` sigmaNet.EXE Execution splunkWindows Password Policy Discovery with Net	2	39
`ScriptBlockText`	`contains`	`Get-ADDefaultDomainPasswordPolicy` sigmaPassword Policy Discovery With Get-AdDefaultDomainPasswordPolicy splunkGet ADDefaultDomainPasswordPolicy with Powershell Script Block	2	2
`ScriptBlockText`	`in`	`Get-ADDefaultDomainPasswordPolicy` elasticDeprecated - PowerShell Script with Discovery Capabilities elasticPowerShell Script with Password Policy Discovery Capabilities	2	2
`process.Ext.api.name`	`eq`	`ldap_search` elasticDomain Password Policy Enumeration via LDAP elasticPassword Spraying Enumeration via LDAP	2	14
`process_basename`	`starts_with`	`powershell*` splunkGet ADUserResultantPasswordPolicy with Powershell splunkGet DomainPolicy with Powershell	2	5
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS High Number Of Failed Authentications For User splunkAWS Password Policy Changes	2	59
`user.id`	`ne`	`S-1-5-18` elasticDomain Password Policy Enumeration via LDAP elasticPassword Spraying Enumeration via LDAP	2	37
`AccessList`	`contains`	`%%5392` sigmaPassword Policy Enumerated	1	2

Exclusions (39 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`wildcard`	`?:\Program Files\Azure Advanced Threat Protection Sensor\*\Microsoft.Tri.Sensor.exe` elasticDomain Password Policy Enumeration via LDAP elasticPassword Spraying Enumeration via LDAP	2
`Image`	`wildcard`	`?:\Windows\ADFS\Microsoft.IdentityServer.ServiceHost.exe` elasticDomain Password Policy Enumeration via LDAP elasticPassword Spraying Enumeration via LDAP	2
`Image`	`wildcard`	`?:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe` elasticDomain Password Policy Enumeration via LDAP elasticPassword Spraying Enumeration via LDAP	2
`Image`	`wildcard`	`?:\Program Files (x86)\Trend Micro\Security Agent\PccNTMon.exe` elasticPassword Spraying Enumeration via LDAP	1
`Image`	`wildcard`	`?:\Program Files\Microsoft SQL Server\MSSQL??.MSSQLSERVER\MSSQL\Binn\sqlservr.exe` elasticPassword Spraying Enumeration via LDAP	1
`user.id`	`eq`	`S-1-5-18` elasticPowerShell Script with Password Policy Discovery Capabilities elasticWindows Account or Group Discovery	2
`CommandLine`	`in`	`/FORCELOGOFF` splunkWindows Password Policy Discovery with Net	1
`CommandLine`	`in`	`/MAXPWAGE` splunkWindows Password Policy Discovery with Net	1
`CommandLine`	`in`	`/MINPWAGE` splunkWindows Password Policy Discovery with Net	1
`CommandLine`	`in`	`/MINPWLEN` splunkWindows Password Policy Discovery with Net	1
`CommandLine`	`in`	`/UNIQUEPW` splunkWindows Password Policy Discovery with Net	1
`ScriptBlockText`	`eq`	`# Copyright: (c) 2018, Ansible Project` elasticPowerShell Suspicious Discovery Related Windows API Functions	1
`ScriptBlockText`	`eq`	`#AnsibleRequires -CSharpUtil Ansible.Basic` elasticPowerShell Suspicious Discovery Related Windows API Functions	1
`ScriptBlockText`	`eq`	`#Requires -Module Ansible.ModuleUtils.AddType` elasticPowerShell Suspicious Discovery Related Windows API Functions	1
`ScriptBlockText`	`eq`	`43c15630-959c-49e4-a977-758c5cc93408` elasticPowerShell Script with Password Policy Discovery Capabilities	1

Password Policy Discovery `T1201`

Events covered

Authoring guide

Fields filtered most (41 distinct)

Top indicator values (309 distinct)

Exclusions (39 distinct)

Rules under this technique

Sigma 8 rules

Elastic 8 rules

Splunk 11 rules

Kusto 2 rules

YARA-L 1 rule

Panther 2 rules

Password Policy Discovery T1201

Events covered

Authoring guide

Fields filtered most (41 distinct)

Top indicator values (309 distinct)

Exclusions (39 distinct)

Rules under this technique

Sigma 8 rules

Elastic 8 rules

Splunk 11 rules

Kusto 2 rules

YARA-L 1 rule

Panther 2 rules

Password Policy Discovery `T1201`