1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T1201 Password Policy Discovery — Attack Simulation

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should…

Technique description

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Connected ecosystem references

Linked tags

enterprisecloudcloud-hosted-endpointidentitynetwork-infrastructureonpremsaasWindowsLinuxmacOSIaaSNetwork DevicesIdentity ProviderSaaSOffice Suitediscoveryisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requireddisposable_tenant_and_cost_controlssome_candidates_require_elevation
can_simulatetechniquesource_mapped

Detection and collection

T1201 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.