Password Policy Discovery (MITRE ATT&CK T1201) is when an adversary reads the password policy of an enterprise network or cloud environment. MITRE files it under Discovery and lists IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows and macOS as platforms.
It is a quiet technique, and the commands are everyday ones.
How attackers use it
Password policies force complex passwords that are hard to guess or crack. Knowing the policy helps an attacker plan. MITRE gives two examples. If the minimum length is 8, the attacker will skip passwords like "pass123". If the lockout threshold is 6, they will try only three or four passwords per account so they do not lock anyone out.
MITRE lists the usual ways to read a policy:
- Windows: net accounts (with /domain for the domain policy) and the PowerShell cmdlet Get-ADDefaultDomainPasswordPolicy.
- Linux: chage -l and reading /etc/pam.d/common-password.
- macOS: pwpolicy getaccountpolicies.
- Network devices: commands in the device CLI such as show aaa and show aaa common-criteria policy all.
- Cloud: APIs such as GetAccountPasswordPolicy in AWS.
The page lists several tools and malware families that collect this with the net accounts command, and utilities that collect account and password information.
How to detect it
MITRE's detection strategy is a chain: a user or service runs one of these queries, optionally reads directory data, and then does something related within a short time, such as account enumeration, credential changes or password attempts.
- Windows. A shell or PowerShell that queries local or domain password policy (net accounts, Get-ADDefaultDomainPasswordPolicy, secedit /export), optionally with LDAP reads from domain controllers. Sysmon process creation, PowerShell script block logging and Security logs together give the picture.
- Linux. Interactive or non-interactive chage -l, or reading PAM files such as /etc/pam.d/common-password and /etc/security/pwquality.conf, and /etc/login.defs. Use auditd execve and file read events, plus shell history.
- macOS. pwpolicy execution, or reads of account policies by MDM or directory services, and of loginwindow preferences or configuration profiles.
- Cloud and identity. API calls that fetch the organization password policy (AWS GetAccountPasswordPolicy and equivalents), or Entra and Graph requests that read password or authentication policies, then risky changes such as role assignment or app consent by the same principal. Use cloud audit and IdP audit logs.
One query is normal for an administrator. The same query from a web server account, or right before a burst of failed logons, is not. Pair it with other discovery activity from the same user and session.
How to reduce the risk
MITRE's mitigation addresses password filters: make sure only valid password filters are registered. Filter DLLs must be in the Windows installation directory (C:\Windows\System32\ by default) of a domain controller or local computer, with a matching entry in HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.
Since reading a policy is hard to block, the practical posture is to make the policy itself resilient. Assume attackers know it. Use long passphrases, a lockout policy that slows guessing, and multi-factor authentication so guessed passwords are not enough.
Check your own environment
On Windows, this lists the registered password filter packages (read-only):
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Notification Packages"
Compare the list with what you expect. Every entry should map to a DLL you can explain.
Also check:
- Do you log process command lines on servers and workstations?
- Is PowerShell script block logging enabled?
- Do you alert when a service account runs net accounts or reads password policy?
- Do you monitor cloud audit logs for password policy reads from unexpected identities?
- Does MFA cover the accounts an attacker would guess first?
Quick check
Why would an attacker want the password policy?
To tailor guesses to the rules, for example skipping passwords that are too short, and to stay under the lockout threshold so accounts do not lock.
Which Linux commands and files does MITRE name?
chage -l and /etc/pam.d/common-password.
