Skip to content

T1201 Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as ‘pass123’; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies 3 2. Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).4

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS 1.

Item Value
ID T1201
Sub-techniques
Tactics TA0007
Platforms IaaS, Linux, Network, Windows, macOS
Version 1.5
Created 18 April 2018
Last Modified 06 September 2022

Procedure Examples

ID Name Description
S0521 BloodHound BloodHound can collect password policy information on the target environment.9
G0114 Chimera Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.12
S0488 CrackMapExec CrackMapExec can discover the password policies applied to the target system.8
S0236 Kwampirs Kwampirs collects password policy information with the command net accounts.10
S0039 Net The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.7
G0049 OilRig OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.11
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the net accounts command as part of their advanced reconnaissance.14
S0378 PoshC2 PoshC2 can use Get-PassPol to enumerate the domain password policy.6
G0010 Turla Turla has used net accounts and net accounts /domain to acquire password policy information.13

Mitigations

ID Mitigation Description
M1027 Password Policies Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. 5

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation
DS0002 User Account User Account Metadata

References

  1. Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021. ↩

  2. Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018. ↩

  3. Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018. ↩

  4. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. ↩

  5. Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017. ↩

  6. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  7. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015. ↩

  8. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. ↩

  9. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. ↩

  10. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  11. Singh, S., Yin, H. (2016, May 22). https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html. Retrieved April 5, 2018. ↩

  12. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩

  13. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  14. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩