Password Policy Enumerated — Sigma Rule

Rule metadata and linked tags

Author: Zach Mathis. Source status: test; severity: medium. Source dates: 2023-05-19 / not supplied.

{
  "product": "windows",
  "service": "security",
  "definition": "dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7c1d116a8e682493ee8b104fb30d8e305c4b22ae4bb2b876747a4ad65e39463f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Password Policy Enumerated
id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199
status: test
description: Detects when the password policy is enumerated.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
    - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
author: Zach Mathis
date: 2023-05-19
tags:
    - attack.discovery
    - attack.t1201
logsource:
    product: windows
    service: security
    definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
    selection:
        EventID: 4661 # A handle to an object was requested.
        AccessList|contains: '%%5392' # ReadPasswordParameters
        ObjectServer: 'Security Account Manager'
    condition: selection
level: medium

Original YAML and metadata in JSON

False positives

No reviewed association in this snapshot.

Source references

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
• https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951