Linux Password Policy Discovery via chage and passwd Commands
Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.
- Product
- linux
- Service
- auditd
- Author
- Ömer Günal, oscd.community, Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2020-10-08
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies attempts to discover Linux password policy information by executing chage or passwd with options that reveal account and password status. Attackers use this knowledge to tailor password-guessing or account-manipulation attempts to local policy constraints. Detection relies on auditd process execution telemetry (EXECVE) for the specific binaries and relevant configuration file names.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md
- linux.die.nethttps://linux.die.net/man/1/chage
- man7.orghttps://man7.org/linux/man-pages/man1/passwd.1.html
- superuser.comhttps://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Password Policy Discovery via chage and passwd Commands
id: 03e03609-39da-4346-b317-c59c818efd4c
status: stable
description: This rule identifies attempts to discover Linux password policy information by executing chage or passwd with options that reveal account and password status. Attackers use this knowledge to tailor password-guessing or account-manipulation attempts to local policy constraints. Detection relies on auditd process execution telemetry (EXECVE) for the specific binaries and relevant configuration file names.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md
- https://linux.die.net/man/1/chage
- https://man7.org/linux/man-pages/man1/passwd.1.html
- https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml
author: Ömer Günal, oscd.community, Pawel Mazur, Huntrule Team
date: 2020-10-08
modified: 2024-12-01
tags:
- attack.discovery
- attack.t1201
logsource:
product: linux
service: auditd
detection:
selection_files:
type: PATH
name:
- /etc/login.defs
- /etc/pam.d/auth
- /etc/pam.d/common-account
- /etc/pam.d/common-auth
- /etc/pam.d/common-password
- /etc/pam.d/system-auth
- /etc/security/pwquality.conf
selection_chage:
type: EXECVE
a0: chage
a1:
- --list
- -l
selection_passwd:
type: EXECVE
a0: passwd
a1:
- -S
- --status
condition: 1 of selection_*
falsepositives:
- Legitimate administration activities
level: low
license: DRL-1.1
related:
- id: ca94a6db-8106-4737-9ed2-3e3bb826af0a
type: derived