Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Technique Password Policy Discovery
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
RU
Риски
Каталоги
MITRE ATT&CK
Техника
Password Policy Discovery
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts). Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a Network Device CLI on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A) Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy).

ID: T1201
Tactic(s): Discovery
Platforms: IaaS, Linux, macOS, Network, Windows
Data Sources: Command: Command Execution, Process: Process Creation, User Account: User Account Metadata
Version: 1.5
Created: 18 Apr 2018
Last Modified: 06 Sep 2022

Procedure Examples
Name Description
Net

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.(Citation: Savill 1999)
CrackMapExec

CrackMapExec can discover the password policies applied to the target system.(Citation: CME Github September 2018)
BloodHound

BloodHound can collect password policy information on the target environment.(Citation: CrowdStrike BloodHound April 2018)

During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
OilRig

OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.(Citation: FireEye Targeted Attacks Middle East Banks)
Chimera

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.(Citation: NCC Group Chimera January 2021)
Kwampirs

Kwampirs collects password policy information with the command net accounts.(Citation: Symantec Orangeworm April 2018)
Turla

Turla has used net accounts and net accounts /domain to acquire password policy information.(Citation: ESET ComRAT May 2020)
PoshC2

PoshC2 can use Get-PassPol to enumerate the domain password policy.(Citation: GitHub PoshC2)

Mitigations
Mitigation Description
Password Policies

Set and enforce secure password policies for accounts.
Password Policy Discovery Mitigation

Mitigating discovery of password policies is not advised since the information is required to be known by systems and users of a network. Ensure password policies are such that they mitigate brute force attacks yet will not give an adversary an information advantage because the policies are too light. Active Directory is a common way to set and enforce password policies throughout an enterprise network. (Citation: Microsoft Password Complexity)

Detection

Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.

References

  1. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
  2. Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.
  3. Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.
  4. Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021.
  5. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  6. Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
  7. Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017.
  8. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
  9. Singh, S., Yin, H. (2016, May 22). https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html. Retrieved April 5, 2018.
  10. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  11. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  12. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  13. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  14. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.