T1201_password-policy-discovery

T1201 Password Policy Discovery

High-Level Description

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies . Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).

Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS .

Kill Chain Phase

• Discovery (TA0007)

Platforms: Windows, Linux, macOS, IaaS, Network Devices, Identity Provider, SaaS, Office Suite

What to Check

• Identify if Password Policy Discovery technique is applicable to target environment
• Check Windows systems for indicators of Password Policy Discovery
• Check Linux systems for indicators of Password Policy Discovery
• Check macOS systems for indicators of Password Policy Discovery
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Examine password complexity policy - Ubuntu

Lists the password complexity policy to console on Ubuntu Linux.

Supported Platforms: linux

cat /etc/pam.d/common-password

Atomic Test 2: Examine password complexity policy - FreeBSD

Lists the password complexity policy to console on FreeBSD.

Supported Platforms: linux

cat /etc/pam.d/passwd

Atomic Test 3: Examine password complexity policy - CentOS/RHEL 7.x

Lists the password complexity policy to console on CentOS/RHEL 7.x Linux.

Supported Platforms: linux

cat /etc/security/pwquality.conf

Dependencies:

• System must be CentOS or RHEL v7

Atomic Test 4: Examine password complexity policy - CentOS/RHEL 6.x

Lists the password complexity policy to console on CentOS/RHEL 6.x Linux.

Supported Platforms: linux

cat /etc/pam.d/system-auth
cat /etc/security/pwquality.conf

Dependencies:

• System must be CentOS or RHEL v6

Atomic Test 5: Examine password expiration policy - All Linux

Lists the password expiration policy to console on CentOS/RHEL/Ubuntu.

Supported Platforms: linux

cat /etc/login.defs

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Password Policy Discovery by examining the target platforms (Windows, Linux, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1201 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1027 Password Policies

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32</code> by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.

Detection

Password Policy Discovery – cross-platform behavior-chain analytics

Risk Assessment

CWE Categories

References

• AWS GetPasswordPolicy
• Jamf User Password Policies
• Superuser Linux Password Policies
• US-CERT-TA18-106A
• Atomic Red Team - T1201
• MITRE ATT&CK - T1201