BIOC
Informational
✕
Password complexity enumeration
Attackers may read system files containing password complexity requirements.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Password Policy Discovery (T1201)
Indicator:
Process action type = execution AND target process cmd = */etc/login.defs* , */etc/pam.d/common-password* , */etc/security/pwquality.conf* , */etc/pam.d/system-auth* AND target process name = grep , head , tail , less , cat Host host os = linux , macos
Preventable: yes