M1027: Password Policies
Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:
Windows Systems:
- Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - Account lockout duration and thresholds.
Linux Systems:
- Configure Pluggable Authentication Modules (PAM): - Use `pam_pwquality` to enforce complexity and length requirements. - Implement `pam_tally2` or `pam_faillock` for account lockouts. - Use `pwunconv` to disable password reuse.
Password Managers:
- Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.
Password Blacklisting:
- Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.
Regular Auditing:
- Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.
*Tools for Implementation*
Windows:
- Group Policy Management Console (GPMC): Enforce password policies. - Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.
Linux/macOS:
- PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules. - Lynis: Audit password policies and system configurations.
Cross-Platform:
- Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords. - Have I Been Pwned API: Prevent the use of breached passwords. - NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.
Security context for executives and security teams
M1027: Password Policies describes Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures: Windows Systems: - Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - ...
Executive priority
M1027: Password Policies is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1027: Password Policies by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1027: Password Policies appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Password Policies
Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:
Windows Systems:
- Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - Account lockout duration and thresholds.
Linux Systems:
- Configure Pluggable Authentication Modules (PAM): - Use `pam_pwquality` to enforce complexity and length requirements. - Implement `pam_tally2` or `pam_faillock` for account lockouts. - Use `pwunconv` to disable password reuse.
Password Managers:
- Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.
Password Blacklisting:
- Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.
Regular Auditing:
- Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.
*Tools for Implementation*
Windows:
- Group Policy Management Console (GPMC): Enforce password policies. - Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.
Linux/macOS:
- PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules. - Lynis: Audit password policies and system configurations.
Cross-Platform:
- Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords. - Have I Been Pwned API: Prevent the use of breached passwords. - NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1599.001 | Network Address Translation TraversalSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1078.004 | Cloud AccountsSub-technique | Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.CitationAWS - IAM Console Best Practices |
| Enterprise | T1556.005 | Reversible EncryptionSub-technique | Ensure that |
| Enterprise | T1552.002 | Credentials in RegistrySub-technique | Do not store credentials within the Registry. |
| Enterprise | T1550.003 | Pass the TicketSub-technique | Ensure that local administrator accounts have complex, unique passwords. |
| Enterprise | T1552.004 | Private KeysSub-technique | Use strong passphrases for private keys to make cracking difficult. |
| Enterprise | T1558.002 | Silver TicketSub-technique | Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.CitationAdSecurity Cracking Kerberos Dec 2015 Also consider using Group Managed Service Accounts or another third party product such as password vaulting.CitationAdSecurity Cracking Kerberos Dec 2015 |
| Enterprise | T1599 | Network Boundary Bridging | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1003.003 | NTDSSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1558.003 | KerberoastingSub-technique | Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.CitationAdSecurity Cracking Kerberos Dec 2015 Also consider using Group Managed Service Accounts or another third party product such as password vaulting.CitationAdSecurity Cracking Kerberos Dec 2015 |
| Enterprise | T1078 | Valid Accounts | Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.CitationUS-CERT Alert TA13-175A Risks of Default Passwords on the Internet When possible, applications that use SSH keys should be updated periodically and properly secured. Policies should minimize (if not eliminate) reuse of passwords between different user accounts, especially employees using the same credentials for personal accounts that may not be defended by enterprise security resources. |
| Enterprise | T1552 | Unsecured Credentials | Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files. |
| Enterprise | T1110.004 | Credential StuffingSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1110.002 | Password CrackingSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1550 | Use Alternate Authentication Material | Set and enforce secure password policies for accounts. |
| Enterprise | T1187 | Forced Authentication | Use strong passwords to increase the difficulty of credential hashes from being cracked if they are obtained. |
| Enterprise | T1003.006 | DCSyncSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1556 | Modify Authentication Process | Ensure that |
| Enterprise | T1003.002 | Security Account ManagerSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1558.004 | AS-REP RoastingSub-technique | Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting. CitationAdSecurity Cracking Kerberos Dec 2015 |
| Enterprise | T1003.004 | LSA SecretsSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1072 | Software Deployment Tools | Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network. |
| Enterprise | T1003 | OS Credential Dumping | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1003.005 | Cached Domain CredentialsSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1078.003 | Local AccountsSub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1003.007 | Proc FilesystemSub-technique | Ensure that root accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1003.008 | /etc/passwd and /etc/shadowSub-technique | Ensure that root accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1078.001 | Default AccountsSub-technique | Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. CitationUS-CERT Alert TA13-175A Risks of Default Passwords on the Internet |
| Enterprise | T1601 | Modify System Image | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1110.001 | Password GuessingSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1555.001 | KeychainSub-technique | The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. |
| Enterprise | T1563.001 | SSH HijackingSub-technique | Ensure SSH key pairs have strong passwords and refrain from using key-store technologies such as ssh-agent unless they are properly protected. |
| Enterprise | T1563 | Remote Service Session Hijacking | Set and enforce secure password policies for accounts. |
| Enterprise | T1078.002 | Domain AccountsSub-technique | Implement and enforce strong password policies for domain accounts to ensure passwords are complex, unique, and regularly rotated. This reduces the likelihood of password guessing, credential stuffing, and other attack methods that rely on weak or static credentials. |
| Enterprise | T1555 | Credentials from Password Stores | The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations. |
| Enterprise | T1110.003 | Password SprayingSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1558 | Steal or Forge Kerberos Tickets | Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.CitationAdSecurity Cracking Kerberos Dec 2015 Also consider using Group Managed Service Accounts or another third party product such as password vaulting.CitationAdSecurity Cracking Kerberos Dec 2015 |
| Enterprise | T1110 | Brute Force | Refer to NIST guidelines when creating password policies.CitationNIST 800-63-3 |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers. |
| Enterprise | T1601.002 | Downgrade System ImageSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
| Enterprise | T1201 | Password Policy Discovery | Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory ( |
| Enterprise | T1021 | Remote Services | Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. |
| Enterprise | T1555.005 | Password ManagersSub-technique | Refer to NIST guidelines when creating password policies for master passwords.CitationNIST 800-63-3 |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. |
| Enterprise | T1003.001 | LSASS MemorySub-technique | Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | Establish an organizational policy that prohibits password storage in files. |
| Enterprise | T1601.001 | Patch System ImageSub-technique | Refer to NIST guidelines when creating password policies. CitationNIST 800-63-3 |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Current bundle | a9d930cbe6b0… | ||
| 19.2 | 1.1 | Older bundle | a9d930cbe6b0… | ||
| 19.1 | 1.1 | Older bundle | a9d930cbe6b0… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1027Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.