Password Policy Discovery - Linux

{
  "selection_files": {
    "type": "PATH",
    "name": [
      "/etc/login.defs",
      "/etc/pam.d/auth",
      "/etc/pam.d/common-account",
      "/etc/pam.d/common-auth",
      "/etc/pam.d/common-password",
      "/etc/pam.d/system-auth",
      "/etc/security/pwquality.conf"
    ]
  },
  "selection_chage": {
    "type": "EXECVE",
    "a0": "chage",
    "a1": [
      "--list",
      "-l"
    ]
  },
  "selection_passwd": {
    "type": "EXECVE",
    "a0": "passwd",
    "a1": [
      "-S",
      "--status"
    ]
  },
  "condition": "1 of selection_*"
}

False Positives

• ⚠ Legitimate administration activities