Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Techniques
  3. Enterprise
  4. Password Policy Discovery

Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack throughBrute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such asnet accounts (/domain),Get-ADDefaultDomainPasswordPolicy,chage -l,cat /etc/pam.d/common-password, andpwpolicy getaccountpolicies[1][2]. Adversaries may also leverage aNetwork Device CLI on network devices to discover password policy information (e.g.show aaa,show aaa common-criteria policy all).[3]

Password policies can be discovered in cloud environments using available APIs such asGetAccountPasswordPolicy in AWS[4].

ID: T1201
Sub-techniques:  No sub-techniques
ⓘ
Tactic:Discovery
ⓘ
Platforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS
Contributors: Austin Clark, @c2defense; Isif Ibrahima, Mandiant; Regina Elwell; Sudhanshu Chauhan, @Sudhanshu_C
Version: 1.7
Created: 18 April 2018
Last Modified: 24 October 2025

Procedure Examples

IDNameDescription
G0114 Chimera

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.[5]

S0488 CrackMapExec

CrackMapExec can discover the password policies applied to the target system.[6]

S0236 Kwampirs

Kwampirs collects password policy information with the commandnet accounts.[7]

S0039 Net

Thenet accounts andnet accounts /domain commands withNet can be used to obtain password policy information.[8]

G0049 OilRig

OilRig has used net.exe in a script withnet accounts /domain to find the password policy of a domain.[9]

C0012 Operation CuckooBees

DuringOperation CuckooBees, the threat actors used thenet accounts command as part of their advanced reconnaissance.[10]

S0378 PoshC2

PoshC2 can useGet-PassPol to enumerate the domain password policy.[11]

G0010 Turla

Turla has usednet accounts andnet accounts /domain to acquire password policy information.[12]

Mitigations

IDMitigationDescription
M1027 Password Policies

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry inHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.[13]

Detection Strategy

IDNameAnalytic IDAnalytic Description
DET0161Password Policy Discovery – cross-platform behavior-chain analyticsAN0455

Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g.,net accounts,Get-ADDefaultDomainPasswordPolicy,secedit /export); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.

AN0456

Chain: (1) interactive/non-interactivechage -l,grep/cat of PAM config (e.g.,/etc/pam.d/common-password,/etc/security/pwquality.conf); (2) optional reads of/etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditdexecve and file read events plus shell history collection.

AN0457

Chain: (1) execution ofpwpolicy or MDM/DirectoryService reads of account policies; (2) optional read of/Library/Preferences/com.apple.loginwindow or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.

AN0458

Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWSGetAccountPasswordPolicy, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.

AN0459

Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.

AN0460

Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ withGet-MsolPasswordPolicy/Get-OrganizationConfig parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.

AN0461

Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g.,show aaa,show password-policy); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.

References

  1. Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.
  2. Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.
  3. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
  4. Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021.
  5. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  6. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
  7. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
×
[8]ページ先頭
©2009-2026 Movatter.jp