PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)
Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-03-17
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies PowerShell script block activity that calls Get-AdDefaultDomainPasswordPolicy to retrieve the default password policy for an Active Directory domain. Attackers can use this information to understand password complexity and other authentication requirements before attempting credential attacks. The rule relies on Script Block Logging telemetry that includes the executed PowerShell code text.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)
id: 9190c770-1ebc-48f3-9085-401e9ef48d26
status: test
description: Identifies PowerShell script block activity that calls Get-AdDefaultDomainPasswordPolicy to retrieve the default password policy for an Active Directory domain. Attackers can use this information to understand password complexity and other authentication requirements before attempting credential attacks. The rule relies on Script Block Logging telemetry that includes the executed PowerShell code text.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
- https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
- attack.discovery
- attack.t1201
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Get-AdDefaultDomainPasswordPolicy
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
- id: bbb9495b-58fc-4016-b9df-9a3a1b67ca82
type: derived