Sigma rule: Password Policy Discovery - Linux

Rule

Title

Password Policy Discovery - Linux

Status

stable

Level

low

Author

Ömer Günal, oscd.community, Pawel Mazur

Date

2020-10-08

Modified

2024-12-01

File

rules/linux/auditd/lnx_auditd_password_policy_discovery.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects password policy discovery commands

Log source

product

linux

service

auditd

Detection

selection_files:
    type: 'PATH'
    name:
        - '/etc/login.defs'
        - '/etc/pam.d/auth'
        - '/etc/pam.d/common-account'
        - '/etc/pam.d/common-auth'
        - '/etc/pam.d/common-password'
        - '/etc/pam.d/system-auth'
        - '/etc/security/pwquality.conf'
selection_chage:
    type: 'EXECVE'
    a0: 'chage'
    a1:
        - '--list'
        - '-l'
selection_passwd:
    type: 'EXECVE'
    a0: 'passwd'
    a1:
        - '-S'
        - '--status'
condition: 1 of selection_*

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.discovery
• attack.t1201

MITRE ATT&CK ids this rule names

• T1201

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md
• https://linux.die.net/man/1/chage
• https://man7.org/linux/man-pages/man1/passwd.1.html
• https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml