Detection rules › Sigma

Password Policy Enumerated

Severity
medium
Author
Zach Mathis
Source
upstream

Detects when the password policy is enumerated.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1201 Password Policy Discovery

Event coverage

ProviderEvent IDTitle
Security-Auditing4661A handle to an object was requested.

Stages and Predicates

Stage 1: selection

AccessList|contains: '%%5392'
ObjectServer: 'Security Account Manager'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AccessListmatch
  • %%5392
ObjectServereq
  • Security Account Manager