{"id":"ca94a6db-8106-4737-9ed2-3e3bb826af0a","title":"Password Policy Discovery - Linux","description":"Detects password policy discovery commands","author":"Ömer Günal, oscd.community, Pawel Mazur","status":"stable","level":"low","date":"2020-10-08","modified":"2024-12-01","tags":["attack.discovery","attack.t1201"],"technique_ids":["T1201"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md","https://linux.die.net/man/1/chage","https://man7.org/linux/man-pages/man1/passwd.1.html","https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"],"source_path":"rules/linux/auditd/lnx_auditd_password_policy_discovery.yml","source_sha256":"6946c5790868c7451cf21b344c5ebafd2fc60349f31c43fd5f8f92fbbcd2fef2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Password Policy Discovery - Linux\nid: ca94a6db-8106-4737-9ed2-3e3bb826af0a\nstatus: stable\ndescription: Detects password policy discovery commands\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md\n    - https://linux.die.net/man/1/chage\n    - https://man7.org/linux/man-pages/man1/passwd.1.html\n    - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu\nauthor: Ömer Günal, oscd.community, Pawel Mazur\ndate: 2020-10-08\nmodified: 2024-12-01\ntags:\n    - attack.discovery\n    - attack.t1201\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection_files:\n        type: 'PATH'\n        name:\n            - '/etc/login.defs'\n            - '/etc/pam.d/auth'\n            - '/etc/pam.d/common-account'\n            - '/etc/pam.d/common-auth'\n            - '/etc/pam.d/common-password'\n            - '/etc/pam.d/system-auth'\n            - '/etc/security/pwquality.conf'\n    selection_chage:\n        type: 'EXECVE'\n        a0: 'chage'\n        a1:\n            - '--list'\n            - '-l'\n    selection_passwd:\n        type: 'EXECVE'\n        a0: 'passwd'\n        a1:\n            - '-S'\n            - '--status'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","page":"techniques/enterprise/T1201/"}],"data_path":"data/detection-rules/ca94a6db-8106-4737-9ed2-3e3bb826af0a.json","kind":"sigma"}