Domain password policy enumeration

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate the domain password policy with native commands or tools like CME (--pass-pol).

Known false positives

Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1201` Password Policy Discovery

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: Domain password policy enumeration
description: Detects scenarios where an attacker attempts to enumerate the domain password policy with native commands or tools like CME (--pass-pol).
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1201-Password%20Policy%20Discovery
- https://hideandsec.sh/books/cheatsheets/page/crackmapexec
- https://www.infosecmatter.com/crackmapexec-module-library/
- https://github.com/PSGumshoe/PSGumshoe/blob/master/DirectoryService/PrivateFunctions.ps1
tags:
- attack.discovery
- attack.t1201
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4661
    ProcessName|endswith: '\lsass.exe'
    ObjectServer: 'Security Account Manager'
    ObjectName|startswith: DC=
    ObjectType: SAM_DOMAIN
    Properties|contains|all:
      - 'c7407360-20bf-11d0-a768-00aa006e0529' # Domain-Password property set
      - 'bf9679a4-0de6-11d0-a285-00aa003049e2' # lockOutObservationWindow
      - 'bf9679a5-0de6-11d0-a285-00aa003049e2' # Lockout-Duration
      - 'bf9679a6-0de6-11d0-a285-00aa003049e2' # lockoutThreshold
      - 'bf9679bb-0de6-11d0-a285-00aa003049e2' # Max-Pwd-Age attribute
      - 'bf9679c2-0de6-11d0-a285-00aa003049e2' # Min-Pwd-Age
      - 'bf9679c3-0de6-11d0-a285-00aa003049e2' # Min-Pwd-Length
      - 'bf967a09-0de6-11d0-a285-00aa003049e2' # Pwd-History-Length
      - 'bf967a0b-0de6-11d0-a285-00aa003049e2' # Pwd-Properties
      - 'bf967977-0de6-11d0-a285-00aa003049e2' # Force-Logoff
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4661
  ProcessName|endswith: '\lsass.exe'
  ObjectServer: 'Security Account Manager'
  ObjectName|startswith: DC=
  ObjectType: SAM_DOMAIN
  Properties|contains|all:
    - 'c7407360-20bf-11d0-a768-00aa006e0529'
    - 'bf9679a4-0de6-11d0-a285-00aa003049e2'
    - 'bf9679a5-0de6-11d0-a285-00aa003049e2'
    - 'bf9679a6-0de6-11d0-a285-00aa003049e2'
    - 'bf9679bb-0de6-11d0-a285-00aa003049e2'
    - 'bf9679c2-0de6-11d0-a285-00aa003049e2'
    - 'bf9679c3-0de6-11d0-a285-00aa003049e2'
    - 'bf967a09-0de6-11d0-a285-00aa003049e2'
    - 'bf967a0b-0de6-11d0-a285-00aa003049e2'
    - 'bf967977-0de6-11d0-a285-00aa003049e2'

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	starts_with	`DC=` corpus 4 (sigma 2, kusto 2)	`field:"ObjectName" kind:starts_with value:"DC="`
`ObjectServer`	eq	`Security Account Manager` corpus 7 (sigma 7)	`field:"ObjectServer" kind:eq value:"Security Account Manager"`
`ObjectType`	eq	`SAM_DOMAIN` corpus 3 (sigma 3)	`field:"ObjectType" kind:eq value:"SAM_DOMAIN"`
`ProcessName`	ends_with	`\lsass.exe` corpus 7 (sigma 7)	`field:"process_name" kind:ends_with value:"\lsass.exe"`
`Properties`	match	`bf967977-0de6-11d0-a285-00aa003049e2` `bf9679a4-0de6-11d0-a285-00aa003049e2` `bf9679a5-0de6-11d0-a285-00aa003049e2` `bf9679a6-0de6-11d0-a285-00aa003049e2` `bf9679bb-0de6-11d0-a285-00aa003049e2` `bf9679c2-0de6-11d0-a285-00aa003049e2` `bf9679c3-0de6-11d0-a285-00aa003049e2` `bf967a09-0de6-11d0-a285-00aa003049e2` `bf967a0b-0de6-11d0-a285-00aa003049e2` `c7407360-20bf-11d0-a768-00aa006e0529`	`field:"Properties" kind:match`