T1201 — Password Policy Discovery

Tactic: Discovery · Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to…

Sigma detection rules (7)

title: T1201 Password Policy Discovery
id: b2fe3ee0-2ceb-4f9b-8943-c72af2889b89
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, PrivilegedUserAllowList, HostRoleScope, PS_ScriptBlockPatterns.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'accounts'

  condition: selection

falsepositives:
  - Routine password-policy review by IT/security auditors.

level: informational

title: T1201 Password Policy Discovery
id: f55ab70f-701f-4c7b-8ba8-7518be6f61f3
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredPaths, ServiceAccountsExclude, TerminalType.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/chage'
      - '/cat'
    a1|contains:
      - '-l'
      - '/etc/login.defs'
      - '/etc/pam.d/common-password'
      - '/etc/security/pwquality.conf'

  condition: selection

falsepositives:
  - chage -l and reading password-policy config files are routine, benign discovery commands used by admins and compliance-scanning tools.

level: informational

title: T1201 Password Policy Discovery
id: 85e48170-6cbe-4364-8a4b-490e7bdb1402
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MDMProfileIDs, AdminConsoleHosts.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/pwpolicy'
    CommandLine|contains: 'getaccountpolicies'

  condition: selection

falsepositives:
  - Compliance-checking scripts and IT audits querying password policy settings routinely.

level: informational

title: T1201 Password Policy Discovery
id: 76adac42-d570-487f-971b-be7061a978bc
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CloudReadOnlyApps, ApiClientIPAllowList.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      - 'GetAccountPasswordPolicy'
      - 'GetCredentialReport'
      - 'GenerateCredentialReport'

  condition: selection

falsepositives:
  - Security and compliance audit tooling checks password policy and credential reports on a scheduled basis, so this is only meaningful when the caller identity does not match a known audit automation role.

level: informational

title: T1201 Password Policy Discovery
id: 67b4956f-0646-40a7-ae7a-07ddce866cce
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Data Component: User Account Metadata; baseline tier: fallback.) Tune using: SaaSAdminGroup, SessionAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Get-PasswordPolicy'
      - 'Get-OrganizationConfig'

  condition: selection

falsepositives:
  - Legitimate compliance or security team audits of tenant password policy configuration.

level: low

title: T1201 Password Policy Discovery
id: 5cdaf638-d9a4-4448-9525-af6064731769
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Data Component: User Account Metadata; baseline tier: fallback.) Tune using: TrustedPartnerAppIds, GeoRiskTolerance.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-06-28
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName: 'Read'
  policy:
    TargetResources|contains: 'PasswordPolicy'

  condition: selection and policy

falsepositives:
  - Entra ID audit logs primarily capture directory write operations, so read-only password policy queries are rarely emitted, limiting detection coverage to tenants with expanded diagnostic logging.

level: low

title: T1201 Password Policy Discovery
id: b9d55911-1410-47b4-84b4-576f568c8e38
description: 'Password Policy Discovery – cross-platform behavior-chain analytics. (Data Component: Command Execution; baseline tier: fallback.) Tune using: ApprovedNOCSources, DeviceTier.'
references:
  - https://attack.mitre.org/techniques/T1201
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.discovery
  - attack.t1201

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_files:
    type: EXECVE
    a0|endswith: '/cat'
    a1|contains:
      - '/etc/pam.d/common-password'
      - '/etc/login.defs'
      - '/etc/security/pwquality.conf'
  selection_chage:
    type: EXECVE
    a0|endswith: '/chage'
    a1|contains: '-l'

  condition: 1 of selection_*

falsepositives:
  - System administrators reviewing or auditing password policy configuration also read these same files with cat or chage as part of routine compliance checks.

level: low

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1201 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan