{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1201","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b2390e7872b07dd0206d894c64f1a31ff0761cf05c8fbbc133d25802fb94a845","description":"Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy</code>, <code>chage -l <username></code>, <code>cat /etc/pam.d/common-password</code>, and <code>pwpolicy getaccountpolicies</code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa</code>, <code>show aaa common-criteria policy all</code>).(Citation: US-CERT-TA18-106A)\n\nPassword policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPasswordPolicy).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1201","external_id":"T1201"},{"source_name":"AWS GetPasswordPolicy","description":"Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021.","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html"},{"source_name":"Jamf User Password Policies","description":"Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.","url":"https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines"},{"source_name":"Superuser Linux Password Policies","description":"Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.","url":"https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}],"platforms":["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0071","name":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component","category":"Windows and directory audit","description":"Access to Active Directory objects and properties.","collection_focus":"Enable Audit Directory Service Access and scoped object SACLs; interpret access masks and property GUIDs in their directory context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","access","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","domain":"enterprise","platforms":["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","identity","network-infrastructure","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1201","technique_page":"techniques/enterprise/T1201/","page":"detections/enterprise/T1201/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"ca94a6db-8106-4737-9ed2-3e3bb826af0a","title":"Password Policy Discovery - Linux","status":"stable","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/ca94a6db-8106-4737-9ed2-3e3bb826af0a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml","author":"Ömer Günal, oscd.community, Pawel Mazur","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"12ba6a38-adb3-4d6b-91ba-a7fb248e3199","title":"Password Policy Enumerated","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64"},"data_path":"data/detection-rules/12ba6a38-adb3-4d6b-91ba-a7fb248e3199.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_password_policy_enumerated.yml","author":"Zach Mathis","kind":"sigma"},{"id":"bbb9495b-58fc-4016-b9df-9a3a1b67ca82","title":"Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/bbb9495b-58fc-4016-b9df-9a3a1b67ca82.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml","author":"frack113","kind":"sigma"},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42a993dd-bb3e-48c8-b372-4d6684c4106c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0161","name":"Password Policy Discovery – cross-platform behavior-chain analytics","url":"https://attack.mitre.org/detectionstrategies/DET0161","stix_id":"x-mitre-detection-strategy--72742281-7457-4124-a277-7f3cf5e23f4e","relationship_id":"relationship--61c33856-75d9-403c-a31c-e7ef853f0796","description":"","analytics":[{"id":"AN0455","name":"Analytic 0455","guidance":"Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g., `net accounts`, `Get-ADDefaultDomainPasswordPolicy`, `secedit /export`); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0455","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window between policy query and adjacent suspicious activity (e.g., 15–30 minutes)."},{"field":"PrivilegedUserAllowList","description":"Accounts (e.g., Helpdesk) allowed to run policy queries routinely."},{"field":"HostRoleScope","description":"Limit alerts on DCs/management servers; raise on user workstations/VDI."},{"field":"PS_ScriptBlockPatterns","description":"Cmdlet/function names to treat as high-signal in your environment."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0455","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0455","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0455","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0455","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0071","component":"Active Directory Object Access","name":"WinEventLog:Security","channel":"EventCode=4662","platforms":["Windows"],"analytic_id":"AN0455","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0455","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0071/"}]},{"id":"AN0456","name":"Analytic 0456","guidance":"Chain: (1) interactive/non-interactive `chage -l`, `grep`/`cat` of PAM config (e.g., `/etc/pam.d/common-password`, `/etc/security/pwquality.conf`); (2) optional reads of `/etc/login.defs`; (3) same user performs account enumeration or password change attempts shortly after. Use auditd `execve` and file read events plus shell history collection.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0456","platforms":["Linux"],"tuning":[{"field":"MonitoredPaths","description":"Exact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ)."},{"field":"ServiceAccountsExclude","description":"System daemons that legitimately parse policies on boot."},{"field":"TerminalType","description":"TTY vs. non-interactive—raise risk for non-interactive remote execution."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0456","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0456","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0013","component":"User Account Metadata","name":"auditd:SYSCALL","channel":"open,openat,read","platforms":["Linux"],"analytic_id":"AN0456","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0456","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"},{"component_id":"DC0064","component":"Command Execution","name":"linux:syslog","channel":"sudo chage|grep pam_pwquality|cat /etc/login.defs","platforms":["Linux"],"analytic_id":"AN0456","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0456","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0457","name":"Analytic 0457","guidance":"Chain: (1) execution of `pwpolicy` or MDM/DirectoryService reads of account policies; (2) optional read of `/Library/Preferences/com.apple.loginwindow` or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0457","platforms":["macOS"],"tuning":[{"field":"MDMProfileIDs","description":"Approved profiles reading/updating auth policies."},{"field":"AdminConsoleHosts","description":"Jamf or management hosts where queries are expected."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"pwpolicy|PasswordPolicy","platforms":["macOS"],"analytic_id":"AN0457","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0457","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"exec /usr/bin/pwpolicy","platforms":["macOS"],"analytic_id":"AN0457","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0457","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0013","component":"User Account Metadata","name":"macos:MDM","channel":"profiles -P|getaccountpolicies","platforms":["macOS"],"analytic_id":"AN0457","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0457","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN0458","name":"Analytic 0458","guidance":"Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWS `GetAccountPasswordPolicy`, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0458","platforms":["IaaS"],"tuning":[{"field":"CloudReadOnlyApps","description":"Approved security tooling principals that routinely read policy."},{"field":"ApiClientIPAllowList","description":"Corporate egress IPs for administrative API access."}],"log_sources":[{"component_id":"DC0013","component":"User Account Metadata","name":"AWS:CloudTrail","channel":"GetAccountPasswordPolicy","platforms":["IaaS"],"analytic_id":"AN0458","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0458","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN0459","name":"Analytic 0459","guidance":"Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0459","platforms":["Identity Provider"],"tuning":[{"field":"TrustedPartnerAppIds","description":"Legitimate partner apps that enumerate policies."},{"field":"GeoRiskTolerance","description":"Raise risk for unusual geo or TOR/VPN egress."}],"log_sources":[{"component_id":"DC0013","component":"User Account Metadata","name":"azure:audit","channel":"operation contains 'Get*Password*Policy' OR 'List*Authentication*Policy' OR 'Get-ADDefaultDomainPasswordPolicy'","platforms":["Identity Provider"],"analytic_id":"AN0459","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0459","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN0460","name":"Analytic 0460","guidance":"Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ with `Get-MsolPasswordPolicy`/`Get-OrganizationConfig` parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0460","platforms":["SaaS"],"tuning":[{"field":"SaaSAdminGroup","description":"Known admin groups or break-glass accounts."},{"field":"SessionAnomalyThreshold","description":"Rate/volume of read operations per session considered anomalous."}],"log_sources":[{"component_id":"DC0013","component":"User Account Metadata","name":"m365:unified","channel":"Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))","platforms":["SaaS"],"analytic_id":"AN0460","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0460","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN0461","name":"Analytic 0461","guidance":"Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g., `show aaa`, `show password-policy`); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.","url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0461","platforms":["Network Devices"],"tuning":[{"field":"ApprovedNOCSources","description":"Jump hosts permitted to run show commands."},{"field":"DeviceTier","description":"Higher risk weight on edge/critical devices."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"cmd='show aaa*' OR 'show running-config | include password|aaa' OR 'show aaa common-criteria policy all'","platforms":["Network Devices"],"analytic_id":"AN0461","source_url":"https://attack.mitre.org/detectionstrategies/DET0161#AN0461","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0071","name":"Active Directory Object Access","tag":"Active Directory Object Access","page":"telemetry/DC0071/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0039","name":"Net","url":"https://attack.mitre.org/software/S0039","kind":"tool","description":"The <code>net accounts</code> and <code>net accounts /domain</code> commands with [Net](https://attack.mitre.org/software/S0039) can be used to obtain password policy information.(Citation: Savill 1999)","relationship_id":"relationship--0224ebf5-13ef-4fb0-b9e7-53ea58c15a4d","references":[{"source_name":"Savill 1999","description":"Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects password policy information with the command <code>net accounts</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--ddda59d4-5455-4d42-901b-b7a227a8a023","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) can use <code>Get-PassPol</code> to enumerate the domain password policy.(Citation: GitHub PoshC2)","relationship_id":"relationship--fd074370-f9d4-43a1-bf1f-0afdb46ab28b","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can discover the password policies applied to the target system.(Citation: CME Github September 2018)","relationship_id":"relationship--11ca4266-5fca-4be4-9bce-275c655c66bd","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has used <code>net accounts</code> and <code>net accounts /domain</code> to acquire password policy information.(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--f946b4f9-a18e-4a1e-856c-2c215f78f8be","references":[{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used net.exe in a script with <code>net accounts /domain</code> to find the password policy of a domain.(Citation: FireEye Targeted Attacks Middle East Banks)","relationship_id":"relationship--5e39caf2-083b-4e4c-b04f-d83c512341cb","references":[{"source_name":"FireEye Targeted Attacks Middle East Banks","description":"Singh, S., Yin, H. (2016, May 22). https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200618235708/https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used the NtdsAudit utility to collect information related to accounts and passwords.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--97833e2b-ae08-49c9-bc1f-b1ab03f982d2","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]}],"mitigations":[{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (<code>C:\\Windows\\System32\\</code> by default) of a domain controller and/or local computer with a corresponding entry in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages</code>. (Citation: Microsoft Install Password Filter n.d)","relationship_id":"relationship--e2748683-077b-4e91-9225-6b29245fdafc","references":[{"source_name":"Microsoft Install Password Filter n.d","description":"Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017.","url":"https://msdn.microsoft.com/library/windows/desktop/ms721766.aspx"}]}],"candidates":[{"id":"085fe567-ac84-47c7-ac4c-2688ce28265b","name":"Examine password complexity policy - Ubuntu","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password complexity policy to console on Ubuntu Linux.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7f67c42a7fa788895d5b01e135c74f480b84c67006d7b70a4aa669b7836ad412"},{"id":"15330820-d405-450b-bd08-16b5be5be9f4","name":"Examine AWS Password Policy","platforms":["iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"This atomic test will display details about the password policy for the current AWS account.\n","inputs":{},"dependencies":[{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"298932a7ad40ddf0022b57dad779b77f24b59f6521946dbbc892ad1e0f48f530"},{"id":"3177f4da-3d4b-4592-8bdc-aa23d0b2e843","name":"Get-DomainPolicy with PowerView","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Utilizing PowerView, run Get-DomainPolicy to return the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f6b76431b770f40d59d396646d74dd120b029f64d97e1d675de5e1f112d60ceb"},{"id":"4588d243-f24e-4549-b2e3-e627acc089f6","name":"Examine local password policy - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the local password policy to console on Windows.\n","inputs":{},"dependencies":[],"source_definition_sha256":"74a5d4ecb9ecf7b5eb8f63b538256ed64effdc286e3fd729b21d561b7ed7dc8a"},{"id":"46c2c362-2679-4ef5-aec9-0e958e135be4","name":"Examine domain password policy - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the domain password policy to console on Windows.\n","inputs":{},"dependencies":[],"source_definition_sha256":"a7f52c141118f4548abfc5fb93826cb6840f003e5aae50c64ed393c35cd86d31"},{"id":"4b7fa042-9482-45e1-b348-4b756b2a0742","name":"Examine password policy - macOS","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password policy to console on macOS.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f7e7185bf0deda5b8aa94aa91a8d094cbe4a3afc1632aa5ea12beacff019de97"},{"id":"510cc97f-56ac-4cd3-a198-d3218c23d889","name":"Use of SecEdit.exe to export the local security policy (including the password policy)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"SecEdit.exe can be used to export the current local security policy applied to a host.\n[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)\n","inputs":{},"dependencies":[],"source_definition_sha256":"0ecb44c0fbde2def3f03f5a36c9ccf172f42f7a71f5d08d95c354d6d12c88d1c"},{"id":"6ce12552-0adb-4f56-89ff-95ce268f6358","name":"Examine password complexity policy - CentOS/RHEL 6.x","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password complexity policy to console on CentOS/RHEL 6.x Linux.\n","inputs":{},"dependencies":[{"description":"System must be CentOS or RHEL v6\n"}],"source_definition_sha256":"28f25dce3f9f041b9742b3e26f9d65c0dbece4192a567f3a4de1c88db531340b"},{"id":"78a12e65-efff-4617-bc01-88f17d71315d","name":"Examine password complexity policy - CentOS/RHEL 7.x","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password complexity policy to console on CentOS/RHEL 7.x Linux.\n","inputs":{},"dependencies":[{"description":"System must be CentOS or RHEL v7\n"}],"source_definition_sha256":"886885cff3958859b71e2aa4dd7c790a292cb37d23a8f587f3a805f0fe56a171"},{"id":"7c86c55c-70fa-4a05-83c9-3aa19b145d1a","name":"Examine password expiration policy - All Linux","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.\n","inputs":{},"dependencies":[],"source_definition_sha256":"db2b4412dac9700349a50b2dc5573abba16451e371b0dbe6b39f529148e55cc4"},{"id":"a7893624-a3d7-4aed-9676-80498f31820f","name":"Examine password complexity policy - FreeBSD","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"Lists the password complexity policy to console on FreeBSD.\n","inputs":{},"dependencies":[],"source_definition_sha256":"a3a283d9ef57774993d4f9b9f44a83656f9d488738881fccf5beb8b37519ee05"},{"id":"b2698b33-984c-4a1c-93bb-e4ba72a0babb","name":"Enumerate Active Directory Password Policy with get-addefaultdomainpasswordpolicy","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml","description":"The following Atomic test will utilize get-addefaultdomainpasswordpolicy to enumerate domain password policy.\nUpon successful execution a listing of the policy implemented will display.\nReference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps\n","inputs":{},"dependencies":[],"source_definition_sha256":"7b4b19594bb1e585d841b1c43edce4b91bd122d6cf90c0b77239b41cacb0a786"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1110":"/ttp-simulation/techniques/enterprise/T1110/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1201":"/ttp-simulation/techniques/enterprise/T1201/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1201","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0071","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","access":"read_property","actor":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}}]}}