Skip to content

Password Policy Discovery

Technique · ATTACK:enterprise:T1201

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1201",
  "title": "Password Policy Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1201",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5",
  "external_id": "T1201",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2025-10-24T17:49:15.781Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "AWS GetPasswordPolicy",
      "url": "https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html"
    },
    {
      "source_name": "Jamf User Password Policies",
      "url": "https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines"
    },
    {
      "source_name": "Superuser Linux Password Policies",
      "url": "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (9)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0224ebf5-13ef-4fb0-b9e7-53ea58c15a4d

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11ca4266-5fca-4be4-9bce-275c655c66bd

CME Github September 2018

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55b9483d-2d73-433c-ad5a-d29dcce6e4e4

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e39caf2-083b-4e4c-b04f-d83c512341cb

FireEye Targeted Attacks Middle East Banks

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97833e2b-ae08-49c9-bc1f-b1ab03f982d2

NCC Group Chimera January 2021

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddda59d4-5455-4d42-901b-b7a227a8a023

Symantec Orangeworm April 2018

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2748683-077b-4e91-9225-6b29245fdafc

Microsoft Install Password Filter n.d

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f946b4f9-a18e-4a1e-856c-2c215f78f8be

ESET ComRAT May 2020

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd074370-f9d4-43a1-bf1f-0afdb46ab28b

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.