Domain Password Policy Queried via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.