Local or domain password policy queried from the command line

Siemphony@siemphonylowT1201unverified

AN0455's first step is a shell or PowerShell process that reads the password policy, and it names the three commands this rule is built from: `net accounts` (with or without `/domain`) for the local or domain lockout and complexity settings, `secedit /export` for the whole local security policy including the password section, and the Active Directory cmdlets that return the domain default and fine-grained policies. Each selection pins the command to its own binary rather than matching the words alone, so a document or script merely mentioning them does not fire; `net1.exe` is included because `net.exe` hands its arguments to it and both process creations are logged. The analytic's later steps are not attempted: the LDAP read leg on Security 4662 and the "same principal does something else suspicious shortly after" correlation inside MITRE's `TimeWindow` knob need a join lib/sigma cannot express, and MITRE's `PrivilegedUserAllowList` and `HostRoleScope` knobs are deployment filters with no field on this event. One coverage gap is worth stating: the AD cmdlets only appear on a command line when they are passed to `powershell.exe -Command` or run from a script invoked that way — typed into an interactive console they leave nothing here, and are visible only in PowerShell EventID 4104, which requires Script Block Logging to be turned on and is off by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0161, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " accounts") or (FolderPath endswith "\\secedit.exe" and ProcessCommandLine contains "/export") or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "Get-ADDefaultDomainPasswordPolicy" or ProcessCommandLine contains "Get-ADFineGrainedPasswordPolicy")))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* accounts*") OR (Image="*\\secedit.exe" AND CommandLine="*/export*") OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-ADDefaultDomainPasswordPolicy*" OR CommandLine="*Get-ADFineGrainedPasswordPolicy*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* accounts*") OR (TO_LOWER(process.executable) LIKE "*\\\\secedit.exe" AND TO_LOWER(process.command_line) LIKE "*/export*") OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*get-addefaultdomainpasswordpolicy*" OR TO_LOWER(process.command_line) LIKE "*get-adfinegrainedpasswordpolicy*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) accounts</field>    <description>Local or domain password policy queried from the command line (1/3)</description>    <mitre>      <id>T1201</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\secedit\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)/export</field>    <description>Local or domain password policy queried from the command line (2/3)</description>    <mitre>      <id>T1201</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(Get-ADDefaultDomainPasswordPolicy|Get-ADFineGrainedPasswordPolicy)</field>    <description>Local or domain password policy queried from the command line (3/3)</description>    <mitre>      <id>T1201</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 5e463356-1977-4200-bb34-2eecd4987438

ATT&CKT1201

T1201Password Policy Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0455's first step is a shell or PowerShell process that reads the password policy, and the rule is built from the three commands the analytic names: net accounts for the local or domain lockout and complexity settings, secedit /export for the whole local security policy including the password section, and the Active Directory cmdlets that return the domain default and fine-grained policies. An adversary reads the policy to size a password-spraying campaign: attempts before lockout, window length, complexity. The rule catches the read, one step before anything harmful happens.

02 · Telemetry you need

category: process_creation, product: windows, in the Sysmon EventID 1 vocabulary. On a Security 4688 feed the same behaviour arrives as NewProcessName, and 4688 needs Audit Process Creation plus the separate Include command line in process creation events policy before CommandLine exists at all — off by default in every baseline.
One coverage gap is worth stating up front: the AD cmdlets only reach a command line when passed to powershell.exe -Command or run from a script invoked that way. Typed into an interactive console they leave nothing here and are visible only in PowerShell EventID 4104, which requires Script Block Logging — also off by default.

03 · How the logic works

Three selections joined by 1 of selection*, each pinning the command to its own binary rather than matching the words alone, so a document or script merely mentioning them does not fire. selection_net requires \net.exe or \net1.exe — both, because net.exe hands its arguments to net1.exe and both process creations are logged — with CommandLine|contains: ' accounts'. Note what that substring does not do: it is unanchored and case-insensitive, so net group "Service Accounts" /domain and net localgroup "Admin Accounts" also satisfy it. Group names containing "Accounts" are a common AD convention, and those commands are T1069/T1087 discovery, not this technique. Anchoring the subcommand with CommandLine|re: '(?i)\bnet1?(\.exe)?"?\s+accounts\b' is the fix. selection_secedit pairs \secedit.exe with '/export'. selection_powershell pairs \powershell.exe/\pwsh.exe with Get-ADDefaultDomainPasswordPolicy or Get-ADFineGrainedPasswordPolicy. Three of MITRE's four knobs cannot live in the rule. TimeWindow — the policy query followed by adjacent suspicious activity — and the LDAP read leg on Security 4662 both need a join lib/sigma cannot express. PrivilegedUserAllowList and HostRoleScope are deployment filters with no field on a single process-creation event.

04 · Common false positives

Configuration and compliance scanning, by a wide margin. secedit /export /cfg is the standard way to read local security policy, and it is what CIS-CAT, the Microsoft Security Compliance Toolkit, SCAP and STIG checkers, Nessus policy audits and SCCM baselines all run on a schedule across every host in scope. That volume sets the level. Behind it: helpdesk running net accounts /domain on a lockout ticket, password-expiry tools calling it once per user per logon, and scheduled governance reports from a management server.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. The rule is derived from a MITRE scaffold containing no query logic and has never been executed against a log line — the `' accounts'` substring collision above was found by reading the YAML, not by testing it.
tier_2: run read-only for a fortnight, rank by host role and account, and let that produce the `HostRoleScope` and allowlist filters.
tier_3: ** demote this to a context signal and alert on the correlation AN0455 actually describes.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the secedit leg into its own rule. It is a whole-policy export only
Anchor the net accounts subcommand as above, or at minimum accept that group
Apply MITRE's HostRoleScope knob: suppress on DCs and management servers,
Use TimeWindow downstream, not here. A policy read followed within 15–30

Declared by the author

Configuration and compliance scanning. secedit /export /cfg is the standard way to read local security policy, and it is what CIS-CAT, the Microsoft Security Compliance Toolkit and LGPO, SCAP and STIG checkers, Nessus local policy audits and SCCM configuration baselines all run — on a schedule, on every host in scope. That is the highest-volume match by a wide margin and is what sets the level here.
Helpdesk and desktop support running net accounts /domain to check the lockout threshold and password age while working a reset or lockout ticket, which is exactly the routine use MITRE's PrivilegedUserAllowList knob exists to exclude.
Logon scripts, password-expiry notification tools and inventory agents that call net accounts or the AD password policy cmdlets to display or report remaining password lifetime, producing one match per user per logon across the fleet.
Directory administrators and reporting automation calling Get-ADDefaultDomainPasswordPolicy from scheduled PowerShell scripts that build audit or governance reports, typically from a management server or jump host.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1201, evaluated against their process_creation events.

Share this rule

/u/siemphony/5e463356-1977-4200-bb34-2eecd4987438

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local or domain password policy queried from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it