Password Policy Enumeration
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Sigma
