Detect Password Policy Discovery in Splunk
Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies enforce complexity requirements that make passwords harder to guess or crack through brute force. By discovering lockout thresholds, minimum length, and complexity rules, adversaries can tailor dictionary and brute force attacks to comply with the policy — maximizing credential testing while avoiding account lockout. Discovery occurs via command-line utilities (net accounts, Get-ADDefaultDomainPasswordPolicy, chage, pwpolicy), cloud APIs (AWS GetAccountPasswordPolicy), and network device CLIs. This technique is commonly observed in the early reconnaissance phase of intrusions by groups including OilRig, Turla, and Chimera.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1201 Password Policy Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1201/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval CommandLine=coalesce(CommandLine, NewProcessName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(coalesce(Image, NewProcessName))
| eval IsNetAccounts=if(
(match(ImageLower, "(net\.exe|net1\.exe)$") AND match(CommandLineLower, "accounts")),
1, 0)
| eval IsPSADPolicy=if(
(match(ImageLower, "(powershell\.exe|pwsh\.exe)$") AND
match(CommandLineLower, "(get-addefaultdomainpasswordpolicy|get-adfinegrainedpasswordpolicy|get-adfinegrainedpasswordpolicysubject|get-passpol)")),
1, 0)
| eval IsNtdsAudit=if(match(CommandLineLower, "ntdsaudit"), 1, 0)
| eval IsCMEPassPol=if(match(CommandLineLower, "(--pass-pol|--password-policy)"), 1, 0)
| eval IsChage=if(match(ImageLower, "chage") AND match(CommandLineLower, "(-l|--list)"), 1, 0)
| eval IsPwPolicy=if(match(ImageLower, "pwpolicy") AND match(CommandLineLower, "getaccountpolicies"), 1, 0)
| eval IsDomainQuery=if(match(CommandLineLower, "(/domain|get-addefaultdomainpasswordpolicy|get-adfinegrainedpasswordpolicy)"), 1, 0)
| eval SuspicionScore=IsNetAccounts + IsPSADPolicy + IsNtdsAudit + IsCMEPassPol + IsChage + IsPwPolicy
| where SuspicionScore > 0
| eval DiscoveryMethod=case(
IsNetAccounts=1 AND IsDomainQuery=1, "net accounts /domain",
IsNetAccounts=1, "net accounts (local)",
IsPSADPolicy=1 AND match(CommandLineLower, "get-passpol"), "PoshC2 Get-PassPol",
IsPSADPolicy=1, "PowerShell AD Password Policy Cmdlet",
IsNtdsAudit=1, "NtdsAudit Utility",
IsCMEPassPol=1, "CrackMapExec-style",
IsChage=1, "Linux chage",
IsPwPolicy=1, "macOS pwpolicy",
1=1, "Other")
| table _time, host, User, ImageLower, CommandLine, ParentImage, ParentCommandLine,
DiscoveryMethod, IsDomainQuery, IsNetAccounts, IsPSADPolicy, IsNtdsAudit, IsCMEPassPol, SuspicionScore
| sort - _timeDetects password policy discovery using Sysmon Event ID 1 (Process Creation) and Windows Security Event ID 4688. Evaluates process images and command lines for net accounts invocations, PowerShell AD password policy cmdlets (including PoshC2's Get-PassPol), NtdsAudit utility, CrackMapExec --pass-pol flags, Linux chage -l, and macOS pwpolicy getaccountpolicies. Assigns a suspicion score and classifies the discovery method to aid analyst triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT administrators running 'net accounts /domain' for routine password policy audits or compliance checks
- Security tools and vulnerability scanners (Nessus, Qualys, CIS-CAT) that enumerate password policy as part of baseline hardening assessments
- Active Directory management scripts and monitoring agents that periodically query domain password policy
- Help desk staff using net accounts to verify lockout policy before resetting a locked account
- Automated identity governance platforms querying fine-grained password policies during access reviews
Other platforms for T1201
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Local Password Policy Discovery via net accounts
Expected signal: Sysmon Event ID 1: Process Create with Image ending in net.exe or net1.exe, CommandLine='net accounts'. Security Event ID 4688 (if command line auditing is enabled) with same details. Parent process will be cmd.exe or the calling shell.
- Test 2Domain Password Policy Discovery via net accounts /domain
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe, CommandLine='net accounts /domain'. Net.exe internally calls net1.exe which also generates a process creation event. The query contacts the PDC emulator — Sysmon Event ID 3 (Network Connect) may show a connection to the DC on port 445 or 135.
- Test 3Domain Password Policy via PowerShell Get-ADDefaultDomainPasswordPolicy
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ADDefaultDomainPasswordPolicy'. PowerShell ScriptBlock Log Event ID 4104 capturing the full command. Sysmon Event ID 7 (Image Load) may show Microsoft.ActiveDirectory.Management.dll being loaded.
- Test 4Linux Password Policy Discovery via PAM configuration
Expected signal: On systems with auditd: syscall audit records for openat()/read() on /etc/security/pwquality.conf and /etc/pam.d/common-password (auditd rule: -w /etc/pam.d/ -p r -k pam_policy_read). Process creation event for chage with -l argument. On MDE Linux agent: DeviceProcessEvents event for chage with ProcessCommandLine containing '-l'.
References (13)
- https://attack.mitre.org/techniques/T1201/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/net-accounts
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html
- https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
- https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://github.com/clymb3r/PowerShell/blob/master/Get-PassHashes/Get-PassHashes.ps1
- https://github.com/byt3bl33d3r/CrackMapExec
- https://github.com/nettitude/PoshC2
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1201/T1201.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_password_policy_discovery.yml
- https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
- https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
Unlock Pro Content
Get the full detection package for T1201 including response playbook, investigation guide, and atomic red team tests.