Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force. This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as
net accounts (/domain),
chage -l ,
cat /etc/pam.d/common-password, and
pwpolicy getaccountpolicies  .
Password policies can be discovered in cloud environments using available APIs such as
GetAccountPasswordPolicy in AWS .
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (
|ID||Data Source||Data Component|
|DS0002||User Account||User Account Metadata|
Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.