- Home
- Techniques
- Enterprise
- Password Policy Discovery
Password Policy Discovery
Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain)
, Get-ADDefaultDomainPasswordPolicy
, chage -l
, cat /etc/pam.d/common-password
, and pwpolicy getaccountpolicies
.[1] [2]
Procedure Examples
Name | Description |
---|---|
BloodHound |
BloodHound can collect password policy information on the target environment.[3] |
CrackMapExec |
CrackMapExec can discover the password policies applied to the target system.[4] |
Kwampirs |
Kwampirs collects password policy information with the command |
Net |
The |
OilRig |
OilRig has used net.exe in a script with |
PoshC2 |
PoshC2 can use |
Turla |
Turla has used |
Mitigations
Mitigation | Description |
---|---|
Password Policies |
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory ( |
Detection
Monitor processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.
References
- Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.
- Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.
- Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
- byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
- Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
- Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
- Singh, S., Yin, H. (2016, May 22). https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html. Retrieved April 5, 2018.
- Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
- Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
- Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017.