Which SIEM platforms have a T1201 detection rule?

df00tech provides T1201 (Password Policy Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Password Policy Discovery (T1201)?

Detecting Password Policy Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1201 detection?

The T1201 detection is rated low severity with high confidence.

What are common false positives for T1201?

Common false positives for T1201 include: IT administrators running 'net accounts /domain' for routine password policy audits or compliance checks; Security tools and vulnerability scanners (Nessus, Qualys, CIS-CAT) that enumerate password policy as part of baseline hardening assessments; Active Directory management scripts and monitoring agents (e.g., Azure AD Connect health, SIEM onboarding scripts) that periodically query domain password policy.

T1201 IBM QRadar · QRadar

Detect Password Policy Discovery in IBM QRadar

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies enforce complexity requirements that make passwords harder to guess or crack through brute force. By discovering lockout thresholds, minimum length, and complexity rules, adversaries can tailor dictionary and brute force attacks to comply with the policy — maximizing credential testing while avoiding account lockout. Discovery occurs via command-line utilities (net accounts, Get-ADDefaultDomainPasswordPolicy, chage, pwpolicy), cloud APIs (AWS GetAccountPasswordPolicy), and network device CLIs. This technique is commonly observed in the early reconnaissance phase of intrusions by groups including OilRig, Turla, and Chimera.

MITRE ATT&CK

Tactic: Discovery
Technique: T1201 Password Policy Discovery
Canonical reference: https://attack.mitre.org/techniques/T1201/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, username, LOGSOURCENAME(logsourceid) AS LogSource,
       "Process Name", "Command",
       CASE
         WHEN LOWER("Command") LIKE '%accounts%' AND (LOWER("Process Name") LIKE '%net.exe' OR LOWER("Process Name") LIKE '%net1.exe') THEN 'net accounts'
         WHEN LOWER("Command") LIKE '%get-addefaultdomainpasswordpolicy%' THEN 'PowerShell AD Cmdlet'
         WHEN LOWER("Command") LIKE '%get-adfinegrainedpasswordpolicy%' THEN 'PowerShell AD Cmdlet'
         WHEN LOWER("Command") LIKE '%get-passpol%' THEN 'PoshC2 Get-PassPol'
         WHEN LOWER("Command") LIKE '%ntdsaudit%' THEN 'NtdsAudit Utility'
         WHEN LOWER("Command") LIKE '%-pass-pol%' OR LOWER("Command") LIKE '%--password-policy%' THEN 'CrackMapExec-style'
         WHEN LOWER("Process Name") LIKE '%chage%' AND (LOWER("Command") LIKE '% -l%' OR LOWER("Command") LIKE '%--list%') THEN 'Linux chage'
         WHEN LOWER("Process Name") LIKE '%pwpolicy%' AND LOWER("Command") LIKE '%getaccountpolicies%' THEN 'macOS pwpolicy'
         ELSE 'Other'
       END AS DiscoveryMethod
FROM events
WHERE LOGSOURCETYPEID IN (12, 13, 45, 143, 352)
  AND starttime > NOW() - 86400000
  AND (
    (LOWER("Process Name") LIKE '%net.exe' OR LOWER("Process Name") LIKE '%net1.exe') AND LOWER("Command") LIKE '%accounts%'
    OR (LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe')
       AND (
         LOWER("Command") LIKE '%get-addefaultdomainpasswordpolicy%'
         OR LOWER("Command") LIKE '%get-adfinegrainedpasswordpolicy%'
         OR LOWER("Command") LIKE '%get-passpol%'
       )
    OR LOWER("Command") LIKE '%ntdsaudit%'
    OR LOWER("Command") LIKE '%-pass-pol%'
    OR LOWER("Command") LIKE '%--password-policy%'
    OR (LOWER("Process Name") LIKE '%chage%' AND (LOWER("Command") LIKE '% -l %' OR LOWER("Command") LIKE '%--list%'))
    OR (LOWER("Process Name") LIKE '%pwpolicy%' AND LOWER("Command") LIKE '%getaccountpolicies%')
  )
ORDER BY starttime DESC

medium severity medium confidence

AQL query for QRadar detecting Password Policy Discovery via Windows Security Event ID 4688 and Sysmon Event ID 1 process creation logs. Identifies net accounts, PowerShell AD cmdlets, NtdsAudit, CrackMapExec, Linux chage, and macOS pwpolicy commands.

Data Sources

Windows Security Events (4688)Sysmon Operational (Event ID 1)Linux auditd

Required Tables

events

False Positives & Tuning

Domain administrators executing periodic password policy audits as part of change management workflows
Vulnerability management tools enumerating Active Directory configuration for compliance reporting
Help desk staff using net accounts to verify lockout thresholds when assisting users

Download portable Sigma rule (.yml)

Other platforms for T1201

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Local Password Policy Discovery via net accounts
Expected signal: Sysmon Event ID 1: Process Create with Image ending in net.exe or net1.exe, CommandLine='net accounts'. Security Event ID 4688 (if command line auditing is enabled) with same details. Parent process will be cmd.exe or the calling shell.
Test 2Domain Password Policy Discovery via net accounts /domain
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine='net accounts /domain'. Net.exe internally calls net1.exe which also generates a process creation event. The query contacts the PDC emulator — Sysmon Event ID 3 (Network Connect) may show a connection to the DC on port 445 or 135.
Test 3Domain Password Policy via PowerShell Get-ADDefaultDomainPasswordPolicy
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ADDefaultDomainPasswordPolicy'. PowerShell ScriptBlock Log Event ID 4104 capturing the full command. Sysmon Event ID 7 (Image Load) may show Microsoft.ActiveDirectory.Management.dll being loaded.
Test 4Linux Password Policy Discovery via PAM configuration
Expected signal: On systems with auditd: syscall audit records for openat()/read() on /etc/security/pwquality.conf and /etc/pam.d/common-password (auditd rule: -w /etc/pam.d/ -p r -k pam_policy_read). Process creation event for chage with -l argument. On MDE Linux agent: DeviceProcessEvents event for chage with ProcessCommandLine containing '-l'.

Last updated: 2026-04-19 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1201 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Password Policy Discovery in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1201

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1201

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox