Windows Security Event 4661 Password Policy Enumeration via ReadPasswordParameters
Flags Windows Event 4661 activity indicating password policy enumeration (ReadPasswordParameters on Security Account Manager).
- Product
- windows
- Service
- security
- Author
- Zach Mathis (SigmaHQ), DRL 1.1
- Published
- 2023-05-19
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security auditing events where a handle request includes the ReadPasswordParameters access (%%5392) against the Security Account Manager. Enumerating the password policy can help an attacker understand local authentication requirements and guide subsequent attacks. It relies on Windows Security log event 4661 telemetry with the specific access right and object server context.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
- github.comhttps://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 4661 Password Policy Enumeration via ReadPasswordParameters
id: afe07da6-1d4f-4572-aa1c-8b2c3c8c3961
status: test
description: This rule flags Windows Security auditing events where a handle request includes the ReadPasswordParameters access (%%5392) against the Security Account Manager. Enumerating the password policy can help an attacker understand local authentication requirements and guide subsequent attacks. It relies on Windows Security log event 4661 telemetry with the specific access right and object server context.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
- https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-19
tags:
- attack.discovery
- attack.t1201
logsource:
product: windows
service: security
definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
selection:
EventID: 4661
AccessList|contains: "%%5392"
ObjectServer: Security Account Manager
condition: selection
level: medium
license: DRL-1.1
related:
- id: 12ba6a38-adb3-4d6b-91ba-a7fb248e3199
type: derived