Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as <code>net accounts (/domain)</code>, <code>Get-ADDefaultDomainPasswordPolicy</code>, <code>chage -l <username></code>, <code>cat /etc/pam.d/common-password</code>, and <code>pwpolicy getaccountpolicies</code> (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. <code>show aaa</code>, <code>show aaa common-criteria policy all</code>).(Citation: US-CERT-TA18-106A)

Password policies can be discovered in cloud environments using available APIs such as <code>GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPasswordPolicy).
Password Policy Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1201  external_id: T1201     source_name: AWS GetPasswordPolicy  description: Amazon Web Services. (n.d.). AWS API GetAccountPasswordPolicy. Retrieved June 8, 2021.  url: https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html     source_name: Jamf User Password Policies  description: Holland, J. (2016, January 25). User password policies on non AD machines. Retrieved April 5, 2018.  url: https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines     source_name: Superuser Linux Password Policies  description: Matutiae, M. (2014, August 6). How to display password policy information for a user (Ubuntu)?. Retrieved April 5, 2018.  url: https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu     source_name: US-CERT-TA18-106A  description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.  url: https://www.us-cert.gov/ncas/alerts/TA18-106A     