Password Policy Enumerated

Status: test
Severity: medium
Log source: product windows, service security
Author: Zach Mathis
Source: github.com/SigmaHQ/sigma

Detects when the password policy is enumerated.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1201` Password Policy Discovery

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: Password Policy Enumerated
id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199
status: test
description: Detects when the password policy is enumerated.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
    - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
author: Zach Mathis
date: 2023-05-19
tags:
    - attack.discovery
    - attack.t1201
logsource:
    product: windows
    service: security
    definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
    selection:
        EventID: 4661 # A handle to an object was requested.
        AccessList|contains: '%%5392' # ReadPasswordParameters
        ObjectServer: 'Security Account Manager'
    condition: selection
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4661
    AccessList|contains: '%%5392'
    ObjectServer: 'Security Account Manager'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessList`	match	`%%5392` corpus 2 (sigma 2)	`field:"AccessList" kind:match value:"%%5392"`
`ObjectServer`	eq	`Security Account Manager` corpus 7 (sigma 7)	`field:"ObjectServer" kind:eq value:"Security Account Manager"`

Password Policy Enumerated

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`