Register to stream ATT&CKcon 2.0 October 29-30

Password Policy Discovery

Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. An adversary may attempt to access detailed information about the password policy used within an enterprise network. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems. [1] [2]

Windows

  • net accounts
  • net accounts /domain

Linux

  • chage -l
  • cat /etc/pam.d/common-password

macOS

  • pwpolicy getaccountpolicies
ID: T1201
Tactic: Discovery
Platform: Windows, Linux, macOS
Permissions Required: User
Data Sources: Process command-line parameters, Process monitoring
Contributors: Sudhanshu Chauhan, @Sudhanshu_C
Version: 1.0

Procedure Examples

Name Description
Kwampirs Kwampirs collects password policy information with the command net accounts. [6]
Net The net accounts and net accounts /domain commands with Net can be used to obtain password policy information. [4]
OilRig OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain. [7]
PoshC2 PoshC2 can use Get-PassPol to enumerate the domain password policy. [5]

Mitigations

Mitigation Description
Password Policies Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. [3]

Detection

Monitor processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.

References