Windows Security: Detect Password Policy Enumeration via Event ID 4661

title: "Windows Security: Detect Password Policy Enumeration via Event ID 4661"
id: afe07da6-1d4f-4572-aa1c-8b2c3c8c3961
status: test
description: This rule identifies when a process requests ReadPasswordParameters access to the Security Account Manager, which corresponds to password policy enumeration. Attackers may use this information to understand domain password settings before attempting credential attacks. The detection relies on Windows Security auditing Event ID 4661 with a matching access mask (%%5392) and the object server set to Security Account Manager.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
  - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-19
tags:
  - attack.discovery
  - attack.t1201
logsource:
  product: windows
  service: security
  definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
  selection:
    EventID: 4661
    AccessList|contains: "%%5392"
    ObjectServer: Security Account Manager
  condition: selection
level: medium
license: DRL-1.1
related:
  - id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199
    type: derived