Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies [1] [2]. Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).[3]

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS [4].

ID: T1201
Sub-techniques:  No sub-techniques
Tactic: Discovery
Platforms: IaaS, Linux, Network, Windows, macOS
Contributors: Austin Clark, @c2defense; Isif Ibrahima, Mandiant; Regina Elwell; Sudhanshu Chauhan, @Sudhanshu_C
Version: 1.5
Created: 18 April 2018
Last Modified: 06 September 2022

Procedure Examples

ID Name Description
S0521 BloodHound

BloodHound can collect password policy information on the target environment.[5]

G0114 Chimera

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.[6]

S0488 CrackMapExec

CrackMapExec can discover the password policies applied to the target system.[7]

S0236 Kwampirs

Kwampirs collects password policy information with the command net accounts.[8]

S0039 Net

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.[9]

G0049 OilRig

OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.[10]

C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the net accounts command as part of their advanced reconnaissance.[11]

S0378 PoshC2

PoshC2 can use Get-PassPol to enumerate the domain password policy.[12]

G0010 Turla

Turla has used net accounts and net accounts /domain to acquire password policy information.[13]

Mitigations

ID Mitigation Description
M1027 Password Policies

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. [14]

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. For network devices, monitor executed commands in AAA logs, especially those run by unexpected or unauthorized users.

DS0009 Process Process Creation

Monitor for newly executed processes that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

DS0002 User Account User Account Metadata

Monitor for contextual data about an account that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

References