Password Policy Discovery
|Password Policy Discovery|
|Platform||Linux, Windows, macOS|
|Data Sources||Process command-line parameters, Process Monitoring|
|Contributors||Sudhanshu Chauhan, @Sudhanshu_C|
Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. An adversary may attempt to access detailed information about the password policy used within an enterprise network. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
net accounts /domain
chage -l <username>
- APT34 has used net.exe in a script with
net accounts /domainto find the password policy of a domain.3
net accounts /domaincommands with Net can be used to obtain password policy information.4
Mitigating discovery of password policies is not advised since the information is required to be known by systems and users of a network. Ensure password policies are such that they mitigate brute force attacks yet will not give an adversary an information advantage because the policies are too light. Active Directory is a common way to set and enforce password policies throughout an enterprise network.5
Monitor processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.
- Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.
- Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.
- Singh, S., Yin, H. (2016, May 22). https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html. Retrieved April 5, 2018.