t1201-password-policy-discovery

name	T1201_password-policy-discovery
description	Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1201","discovery","windows","linux","macos","iaas","network-devices","identity-provider","saas","office-suite"]
technique_id	T1201
tactic	discovery
all_tactics	["discovery"]
platforms	["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"]
mitre_url	https://attack.mitre.org/techniques/T1201
tech_stack	["windows","linux","macos","cloud","network devices","identity","saas","office"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1201 Password Policy Discovery

High-Level Description

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies . Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS .

Kill Chain Phase

• Discovery (TA0007)

Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite

What to Check

• Identify if Password Policy Discovery technique is applicable to target environment
• Check Windows systems for indicators of Password Policy Discovery
• Check Linux systems for indicators of Password Policy Discovery
• Check macOS systems for indicators of Password Policy Discovery
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Examine password complexity policy - Ubuntu

Lists the password complexity policy to console on Ubuntu Linux.