Linux Password Policy Discovery via chage and passwd

title: Linux Password Policy Discovery via chage and passwd
id: 03e03609-39da-4346-b317-c59c818efd4c
status: stable
description: This rule flags Linux auditd events where a process runs chage with list/status-style arguments or passwd with status-style arguments, alongside access to common password policy configuration files. Attackers and administrators use these sources to identify password policy settings such as expiration and complexity requirements, which can inform further credential-focused actions. The detection relies on EXECVE telemetry for chage/waswo and file path telemetry for key authentication and password policy configuration locations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md
  - https://linux.die.net/man/1/chage
  - https://man7.org/linux/man-pages/man1/passwd.1.html
  - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml
author: Ömer Günal, oscd.community, Pawel Mazur, Huntrule Team
date: 2020-10-08
modified: 2024-12-01
tags:
  - attack.discovery
  - attack.t1201
logsource:
  product: linux
  service: auditd
detection:
  selection_files:
    type: PATH
    name:
      - /etc/login.defs
      - /etc/pam.d/auth
      - /etc/pam.d/common-account
      - /etc/pam.d/common-auth
      - /etc/pam.d/common-password
      - /etc/pam.d/system-auth
      - /etc/security/pwquality.conf
  selection_chage:
    type: EXECVE
    a0: chage
    a1:
      - --list
      - -l
  selection_passwd:
    type: EXECVE
    a0: passwd
    a1:
      - -S
      - --status
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: ca94a6db-8106-4737-9ed2-3e3bb826af0a
    type: derived