Which SIEM platforms have a T1201 detection rule?

df00tech provides T1201 (Password Policy Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Password Policy Discovery (T1201)?

Detecting Password Policy Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1201 detection?

The T1201 detection is rated low severity with high confidence.

What are common false positives for T1201?

Common false positives for T1201 include: IT administrators running 'net accounts /domain' for routine password policy audits or compliance checks; Security tools and vulnerability scanners (Nessus, Qualys, CIS-CAT) that enumerate password policy as part of baseline hardening assessments; Active Directory management scripts and monitoring agents (e.g., Azure AD Connect health, SIEM onboarding scripts) that periodically query domain password policy.

T1201

Password Policy Discovery

Discovery Last updated: April 19, 2026

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies enforce complexity requirements that make passwords harder to guess or crack through brute force. By discovering lockout thresholds, minimum length, and complexity rules, adversaries can tailor dictionary and brute force attacks to comply with the policy — maximizing credential testing while avoiding account lockout. Discovery occurs via command-line utilities (net accounts, Get-ADDefaultDomainPasswordPolicy, chage, pwpolicy), cloud APIs (AWS GetAccountPasswordPolicy), and network device CLIs. This technique is commonly observed in the early reconnaissance phase of intrusions by groups including OilRig, Turla, and Chimera.

What is T1201 Password Policy Discovery?

Password Policy Discovery (T1201) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Password Policy Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Discovery
Technique: T1201 Password Policy Discovery
Canonical reference: https://attack.mitre.org/techniques/T1201/

Microsoft Sentinel / Defender

kusto

let PasswordPolicyCommands = dynamic([
  "net accounts",
  "net.exe accounts",
  "Get-ADDefaultDomainPasswordPolicy",
  "Get-ADFineGrainedPasswordPolicy",
  "Get-PassPol",
  "pwpolicy",
  "chage -l",
  "chage --list",
  "pam.d",
  "common-password",
  "pwquality",
  "show aaa",
  "NtdsAudit"
]);
let PasswordPolicyCmdlets = dynamic([
  "Get-ADDefaultDomainPasswordPolicy",
  "Get-ADFineGrainedPasswordPolicy",
  "Get-ADFineGrainedPasswordPolicySubject",
  "Get-PassPol"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // net accounts and net accounts /domain
    (FileName =~ "net.exe" or FileName =~ "net1.exe") and ProcessCommandLine has "accounts"
  ) or (
    // PowerShell AD password policy cmdlets
    (FileName =~ "powershell.exe" or FileName =~ "pwsh.exe") and
    ProcessCommandLine has_any (PasswordPolicyCmdlets)
  ) or (
    // CrackMapExec or other tools querying password policy via LDAP/WMI patterns
    ProcessCommandLine has_any ("NtdsAudit", "--pass-pol", "--password-policy")
  ) or (
    // Linux: chage command reading password aging info
    FileName =~ "chage" and (ProcessCommandLine has "-l" or ProcessCommandLine has "--list")
  ) or (
    // macOS: pwpolicy command
    FileName =~ "pwpolicy" and ProcessCommandLine has "getaccountpolicies"
  )
| extend DiscoveryMethod = case(
    ProcessCommandLine has "accounts /domain" or ProcessCommandLine has "accounts", "net accounts",
    ProcessCommandLine has_any ("Get-ADDefaultDomainPasswordPolicy", "Get-ADFineGrainedPasswordPolicy"), "PowerShell AD Cmdlet",
    ProcessCommandLine has "Get-PassPol", "PoshC2 Get-PassPol",
    ProcessCommandLine has "NtdsAudit", "NtdsAudit Utility",
    ProcessCommandLine has "chage", "Linux chage",
    ProcessCommandLine has "pwpolicy", "macOS pwpolicy",
    ProcessCommandLine has_any ("--pass-pol", "--password-policy"), "CrackMapExec-style",
    "Other"
  )
| extend IsDomainQuery = ProcessCommandLine has "/domain" or ProcessCommandLine has_any ("Get-ADDefaultDomainPasswordPolicy", "Get-ADFineGrainedPasswordPolicy")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DiscoveryMethod, IsDomainQuery
| sort by Timestamp desc

Detects password policy discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors for net.exe/net1.exe with 'accounts' arguments (local and domain), PowerShell AD password policy cmdlets (Get-ADDefaultDomainPasswordPolicy, Get-ADFineGrainedPasswordPolicy), PoshC2's Get-PassPol, NtdsAudit utility usage, Linux chage -l enumeration, macOS pwpolicy getaccountpolicies, and CrackMapExec-style --pass-pol flags. Enriches events with the discovery method and whether the query targets the domain policy.

low severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

IT administrators running 'net accounts /domain' for routine password policy audits or compliance checks
Security tools and vulnerability scanners (Nessus, Qualys, CIS-CAT) that enumerate password policy as part of baseline hardening assessments
Active Directory management scripts and monitoring agents (e.g., Azure AD Connect health, SIEM onboarding scripts) that periodically query domain password policy
Help desk staff using net accounts to verify lockout policy before resetting a locked account
Automated identity governance platforms (SailPoint, Saviynt) querying fine-grained password policies during access reviews

Splunk

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval CommandLine=coalesce(CommandLine, NewProcessName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(coalesce(Image, NewProcessName))
| eval IsNetAccounts=if(
    (match(ImageLower, "(net\.exe|net1\.exe)$") AND match(CommandLineLower, "accounts")),
    1, 0)
| eval IsPSADPolicy=if(
    (match(ImageLower, "(powershell\.exe|pwsh\.exe)$") AND
     match(CommandLineLower, "(get-addefaultdomainpasswordpolicy|get-adfinegrainedpasswordpolicy|get-adfinegrainedpasswordpolicysubject|get-passpol)")),
    1, 0)
| eval IsNtdsAudit=if(match(CommandLineLower, "ntdsaudit"), 1, 0)
| eval IsCMEPassPol=if(match(CommandLineLower, "(--pass-pol|--password-policy)"), 1, 0)
| eval IsChage=if(match(ImageLower, "chage") AND match(CommandLineLower, "(-l|--list)"), 1, 0)
| eval IsPwPolicy=if(match(ImageLower, "pwpolicy") AND match(CommandLineLower, "getaccountpolicies"), 1, 0)
| eval IsDomainQuery=if(match(CommandLineLower, "(/domain|get-addefaultdomainpasswordpolicy|get-adfinegrainedpasswordpolicy)"), 1, 0)
| eval SuspicionScore=IsNetAccounts + IsPSADPolicy + IsNtdsAudit + IsCMEPassPol + IsChage + IsPwPolicy
| where SuspicionScore > 0
| eval DiscoveryMethod=case(
    IsNetAccounts=1 AND IsDomainQuery=1, "net accounts /domain",
    IsNetAccounts=1, "net accounts (local)",
    IsPSADPolicy=1 AND match(CommandLineLower, "get-passpol"), "PoshC2 Get-PassPol",
    IsPSADPolicy=1, "PowerShell AD Password Policy Cmdlet",
    IsNtdsAudit=1, "NtdsAudit Utility",
    IsCMEPassPol=1, "CrackMapExec-style",
    IsChage=1, "Linux chage",
    IsPwPolicy=1, "macOS pwpolicy",
    1=1, "Other")
| table _time, host, User, ImageLower, CommandLine, ParentImage, ParentCommandLine,
        DiscoveryMethod, IsDomainQuery, IsNetAccounts, IsPSADPolicy, IsNtdsAudit, IsCMEPassPol, SuspicionScore
| sort - _time

Detects password policy discovery using Sysmon Event ID 1 (Process Creation) and Windows Security Event ID 4688. Evaluates process images and command lines for net accounts invocations, PowerShell AD password policy cmdlets (including PoshC2's Get-PassPol), NtdsAudit utility, CrackMapExec --pass-pol flags, Linux chage -l, and macOS pwpolicy getaccountpolicies. Assigns a suspicion score and classifies the discovery method to aid analyst triage.

low severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1 Windows Security Event ID 4688

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

IT administrators running 'net accounts /domain' for routine password policy audits or compliance checks
Security tools and vulnerability scanners (Nessus, Qualys, CIS-CAT) that enumerate password policy as part of baseline hardening assessments
Active Directory management scripts and monitoring agents that periodically query domain password policy
Help desk staff using net accounts to verify lockout policy before resetting a locked account
Automated identity governance platforms querying fine-grained password policies during access reviews

IBM QRadar (AQL)

sql

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, username, LOGSOURCENAME(logsourceid) AS LogSource,
       "Process Name", "Command",
       CASE
         WHEN LOWER("Command") LIKE '%accounts%' AND (LOWER("Process Name") LIKE '%net.exe' OR LOWER("Process Name") LIKE '%net1.exe') THEN 'net accounts'
         WHEN LOWER("Command") LIKE '%get-addefaultdomainpasswordpolicy%' THEN 'PowerShell AD Cmdlet'
         WHEN LOWER("Command") LIKE '%get-adfinegrainedpasswordpolicy%' THEN 'PowerShell AD Cmdlet'
         WHEN LOWER("Command") LIKE '%get-passpol%' THEN 'PoshC2 Get-PassPol'
         WHEN LOWER("Command") LIKE '%ntdsaudit%' THEN 'NtdsAudit Utility'
         WHEN LOWER("Command") LIKE '%-pass-pol%' OR LOWER("Command") LIKE '%--password-policy%' THEN 'CrackMapExec-style'
         WHEN LOWER("Process Name") LIKE '%chage%' AND (LOWER("Command") LIKE '% -l%' OR LOWER("Command") LIKE '%--list%') THEN 'Linux chage'
         WHEN LOWER("Process Name") LIKE '%pwpolicy%' AND LOWER("Command") LIKE '%getaccountpolicies%' THEN 'macOS pwpolicy'
         ELSE 'Other'
       END AS DiscoveryMethod
FROM events
WHERE LOGSOURCETYPEID IN (12, 13, 45, 143, 352)
  AND starttime > NOW() - 86400000
  AND (
    (LOWER("Process Name") LIKE '%net.exe' OR LOWER("Process Name") LIKE '%net1.exe') AND LOWER("Command") LIKE '%accounts%'
    OR (LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe')
       AND (
         LOWER("Command") LIKE '%get-addefaultdomainpasswordpolicy%'
         OR LOWER("Command") LIKE '%get-adfinegrainedpasswordpolicy%'
         OR LOWER("Command") LIKE '%get-passpol%'
       )
    OR LOWER("Command") LIKE '%ntdsaudit%'
    OR LOWER("Command") LIKE '%-pass-pol%'
    OR LOWER("Command") LIKE '%--password-policy%'
    OR (LOWER("Process Name") LIKE '%chage%' AND (LOWER("Command") LIKE '% -l %' OR LOWER("Command") LIKE '%--list%'))
    OR (LOWER("Process Name") LIKE '%pwpolicy%' AND LOWER("Command") LIKE '%getaccountpolicies%')
  )
ORDER BY starttime DESC

AQL query for QRadar detecting Password Policy Discovery via Windows Security Event ID 4688 and Sysmon Event ID 1 process creation logs. Identifies net accounts, PowerShell AD cmdlets, NtdsAudit, CrackMapExec, Linux chage, and macOS pwpolicy commands.

medium severity medium confidence

Data Sources

Windows Security Events (4688) Sysmon Operational (Event ID 1) Linux auditd

Required Tables

events

False Positives

Domain administrators executing periodic password policy audits as part of change management workflows
Vulnerability management tools enumerating Active Directory configuration for compliance reporting
Help desk staff using net accounts to verify lockout thresholds when assisting users

Sumo Logic CSE

sql

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse regex field=_raw "(?:Image|NewProcessName)[=>\s]+(?P<Image>[^\r\n<]+)" nodrop
| parse regex field=_raw "(?:CommandLine|ProcessCommandLine)[=>\s]+(?P<CommandLine>[^\r\n<]+)" nodrop
| parse regex field=_raw "(?:ParentImage|ParentProcessName)[=>\s]+(?P<ParentImage>[^\r\n<]+)" nodrop
| parse regex field=_raw "(?:User|SubjectUserName)[=>\s]+(?P<User>[^\r\n<]+)" nodrop
| where !éisEmpty(CommandLine)
| eval ImageLower = toLowerCase(Image)
| eval CmdLower = toLowerCase(CommandLine)
| eval IsNetAccounts = if(matches(ImageLower, ".*(net\.exe|net1\.exe)$") and matches(CmdLower, ".*accounts.*"), 1, 0)
| eval IsPSADPolicy = if(
    matches(ImageLower, ".*(powershell\.exe|pwsh\.exe)$") and (
      matches(CmdLower, ".*get-addefaultdomainpasswordpolicy.*") or
      matches(CmdLower, ".*get-adfinegrainedpasswordpolicy.*") or
      matches(CmdLower, ".*get-passpol.*")
    ), 1, 0)
| eval IsNtdsAudit = if(matches(CmdLower, ".*ntdsaudit.*"), 1, 0)
| eval IsCMEPassPol = if(matches(CmdLower, ".*(--pass-pol|--password-policy).*"), 1, 0)
| eval IsChage = if(matches(ImageLower, ".*chage.*") and (matches(CmdLower, ".*-l.*") or matches(CmdLower, ".*--list.*")), 1, 0)
| eval IsPwPolicy = if(matches(ImageLower, ".*pwpolicy.*") and matches(CmdLower, ".*getaccountpolicies.*"), 1, 0)
| eval SuspicionScore = IsNetAccounts + IsPSADPolicy + IsNtdsAudit + IsCMEPassPol + IsChage + IsPwPolicy
| where SuspicionScore > 0
| eval IsDomainQuery = if(matches(CmdLower, ".*/domain.*") or matches(CmdLower, ".*get-addefaultdomainpasswordpolicy.*") or matches(CmdLower, ".*get-adfinegrainedpasswordpolicy.*"), "true", "false")
| eval DiscoveryMethod = if(IsNetAccounts=1 and IsDomainQuery="true", "net accounts /domain",
    if(IsNetAccounts=1, "net accounts (local)",
    if(IsPSADPolicy=1 and matches(CmdLower, ".*get-passpol.*"), "PoshC2 Get-PassPol",
    if(IsPSADPolicy=1, "PowerShell AD Cmdlet",
    if(IsNtdsAudit=1, "NtdsAudit Utility",
    if(IsCMEPassPol=1, "CrackMapExec-style",
    if(IsChage=1, "Linux chage",
    if(IsPwPolicy=1, "macOS pwpolicy", "Other"))))))))
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DiscoveryMethod, IsDomainQuery, SuspicionScore
| sort by _messageTime desc

Sumo Logic query detecting T1201 Password Policy Discovery across Windows (Sysmon/Security), Linux, and macOS systems. Parses process execution events and scores suspicious commands used to enumerate password policies.

medium severity high confidence

Data Sources

Windows Sysmon (Event ID 1) Windows Security Event ID 4688 Linux auditd/syslog

Required Tables

_sourceCategory=windows/sysmon _sourceCategory=windows/security

False Positives

IT operations teams running automated AD health check scripts that enumerate password policies nightly
Security operations tools like BloodHound or Purple Knight legitimately querying AD password policy for assessment purposes
System administrators using 'net accounts' to verify GPO-enforced policy after configuration changes

Google Chronicle / SecOps

yaral

rule t1201_password_policy_discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Password Policy Discovery (T1201) via process execution of net accounts, PowerShell AD cmdlets, chage, pwpolicy, NtdsAudit, or CrackMapExec password policy enumeration."
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1201"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path != ""

    (
      // net.exe accounts or net1.exe accounts
      (re.regex($e.principal.process.file.full_path, `(?i)(net\.exe|net1\.exe)$`) and
       re.regex($e.principal.process.command_line, `(?i)accounts`))
      or
      // PowerShell AD password policy cmdlets
      (re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`) and
       re.regex($e.principal.process.command_line, `(?i)(Get-ADDefaultDomainPasswordPolicy|Get-ADFineGrainedPasswordPolicy|Get-ADFineGrainedPasswordPolicySubject|Get-PassPol)`))
      or
      // NtdsAudit utility
      re.regex($e.principal.process.command_line, `(?i)NtdsAudit`)
      or
      // CrackMapExec-style password policy flags
      re.regex($e.principal.process.command_line, `(?i)(--pass-pol|--password-policy)`)
      or
      // Linux chage -l / --list
      (re.regex($e.principal.process.file.full_path, `(?i)chage$`) and
       re.regex($e.principal.process.command_line, `(?i)(-l\b|--list)`))
      or
      // macOS pwpolicy getaccountpolicies
      (re.regex($e.principal.process.file.full_path, `(?i)pwpolicy$`) and
       re.regex($e.principal.process.command_line, `(?i)getaccountpolicies`))
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting T1201 Password Policy Discovery. Matches PROCESS_LAUNCH UDM events where command-line arguments indicate enumeration of password policy settings using native OS utilities or common offensive security tools.

medium severity high confidence

Data Sources

Google Chronicle UDM via Endpoint sensor Windows Sysmon forwarded to Chronicle Chronicle Unified Data Model PROCESS_LAUNCH events

Required Tables

UDM PROCESS_LAUNCH events

False Positives

Privileged IT staff running Get-ADDefaultDomainPasswordPolicy as part of regular Active Directory audits or compliance checks
Security assessment tools (e.g., PingCastle, BloodHound) querying AD password policy during authorized assessments
Linux system administrators using chage -l to review user account aging settings for compliance

CrowdStrike LogScale (CQL)

cql

#repo=base_sensor #event_simpleName=ProcessRollup2
| FileName = /(?i)(net\.exe|net1\.exe|powershell\.exe|pwsh\.exe|chage|pwpolicy)$/
| CommandLine = /(?i)(accounts|Get-ADDefaultDomainPasswordPolicy|Get-ADFineGrainedPasswordPolicy|Get-ADFineGrainedPasswordPolicySubject|Get-PassPol|NtdsAudit|--pass-pol|--password-policy|getaccountpolicies)/
| case {
    FileName = /(?i)(net\.exe|net1\.exe)/ AND CommandLine = /(?i)accounts/ | DiscoveryMethod := "net accounts" ;
    CommandLine = /(?i)Get-ADDefaultDomainPasswordPolicy/ | DiscoveryMethod := "PowerShell AD Cmdlet" ;
    CommandLine = /(?i)Get-ADFineGrainedPasswordPolicy/ | DiscoveryMethod := "PowerShell AD Fine-Grained Cmdlet" ;
    CommandLine = /(?i)Get-PassPol/ | DiscoveryMethod := "PoshC2 Get-PassPol" ;
    CommandLine = /(?i)NtdsAudit/ | DiscoveryMethod := "NtdsAudit Utility" ;
    CommandLine = /(?i)(--pass-pol|--password-policy)/ | DiscoveryMethod := "CrackMapExec-style" ;
    FileName = /(?i)chage/ AND CommandLine = /(?i)(-l\b|--list)/ | DiscoveryMethod := "Linux chage" ;
    FileName = /(?i)pwpolicy/ AND CommandLine = /(?i)getaccountpolicies/ | DiscoveryMethod := "macOS pwpolicy" ;
    * | DiscoveryMethod := "Other"
  }
| IsDomainQuery := if(CommandLine = /(?i)(/domain|Get-ADDefaultDomainPasswordPolicy|Get-ADFineGrainedPasswordPolicy)/, "true", "false")
| table([_timeutc, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DiscoveryMethod, IsDomainQuery])
| sort(field=_timeutc, order=desc)

CrowdStrike LogScale (Falcon SIEM) query detecting T1201 Password Policy Discovery using ProcessRollup2 events. Identifies net accounts, PowerShell AD password policy cmdlets, NtdsAudit, CrackMapExec flags, Linux chage, and macOS pwpolicy commands with discovery method classification.

medium severity high confidence

Data Sources

CrowdStrike Falcon Endpoint sensor (ProcessRollup2 events) Falcon Data Replicator (FDR)

Required Tables

base_sensor ProcessRollup2

False Positives

IT administrators or help desk staff using 'net accounts' to verify lockout threshold settings after user lockout incidents
Automated compliance scanning tools running PowerShell AD cmdlets to export policy configuration for audit reports
Red team or penetration testing activity on systems designated for authorized security assessments

Sigma rule & cross-platform mapping

The detection logic for Password Policy Discovery (T1201) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1201 Sigma rules on detection.fyi

Platform-specific guides for T1201

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-19 Research depth: deep

References (11)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Local Password Policy Discovery via net accounts
Expected signal: Sysmon Event ID 1: Process Create with Image ending in net.exe or net1.exe, CommandLine='net accounts'. Security Event ID 4688 (if command line auditing is enabled) with same details. Parent process will be cmd.exe or the calling shell.
Test 2Domain Password Policy Discovery via net accounts /domain
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine='net accounts /domain'. Net.exe internally calls net1.exe which also generates a process creation event. The query contacts the PDC emulator — Sysmon Event ID 3 (Network Connect) may show a connection to the DC on port 445 or 135.
Test 3Domain Password Policy via PowerShell Get-ADDefaultDomainPasswordPolicy
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ADDefaultDomainPasswordPolicy'. PowerShell ScriptBlock Log Event ID 4104 capturing the full command. Sysmon Event ID 7 (Image Load) may show Microsoft.ActiveDirectory.Management.dll being loaded.
Test 4Linux Password Policy Discovery via PAM configuration
Expected signal: On systems with auditd: syscall audit records for openat()/read() on /etc/security/pwquality.conf and /etc/pam.d/common-password (auditd rule: -w /etc/pam.d/ -p r -k pam_policy_read). Process creation event for chage with -l argument. On MDE Linux agent: DeviceProcessEvents event for chage with ProcessCommandLine containing '-l'.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1201 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Password Policy Discovery

What is T1201 Password Policy Discovery?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1201

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Discovery

Popular Detections

What is T1201 Password Policy Discovery?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1201

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox