Password Policy Discovery with Get-AdDefaultDomainPasswordPolicy

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.