Password Policy Enumerated

Rule Info

Tags
attack.discovery DEMO attack.t1201
Name
Password Policy Enumerated
Id
12ba6a38-adb3-4d6b-91ba-a7fb248e3199
Date
2023-05-19 00:00:00
Modified
None
Description
Detects when the password policy is enumerated.
Reference
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661
Author
Zach Mathis
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=12ba6a38-adb3-4d6b-91ba-a7fb248e3199

Rule History

Title
Author
Commit
Date
chore: update metadata
Nasreddine Bencherchali
bc0cdf541
2023-05-18
rename filename
Yamato Security
2b2988286
2023-05-17
new rule password policy enumerated
Yamato Security
4b3821391
2023-05-17
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022