Pass-the-Hash

What Pass-the-Hash Is and Why It Works

• Pass-the-Hash (PtH) is a credential theft and lateral movement technique where an attacker authenticates to a remote system using the NTLM hash of a user’s password instead of the plaintext password.
• MITRE ATT&CK maps this to T1550.002 (Use Alternate Authentication Material: Pass the Hash).
• The technique exploits a fundamental design property of NTLM authentication: the protocol never transmits the plaintext password. The client proves possession of the password by encrypting a server-sent challenge with the NTLM hash. Since the hash itself is the authenticating material, possessing the hash is functionally equivalent to possessing the password.

How PtH Works — The Protocol Attack

Normal NTLM Authentication

Client                                Server
  |                                     |
  | --- Authentication Request ------>  |
  |                                     |
  | <--- Challenge (16-byte random) --- |
  |                                     |
  | --- Challenge encrypted with      |
  |     NTLM hash of password --------> |
  |                                     |
  | Server encrypts the same challenge |
  | with the stored NTLM hash --------- |
  | (both must match)                   |

Pass-the-Hash Attack

Attacker (has harvested NTLM hash)     Target Server
  |                                     |
  | --- Authentication Request ------>  |
  |                                     |
  | <--- Challenge -------------------  |
  |                                     |
  | --- Challenge encrypted with      |
  |     **harvested** NTLM hash ------>  |
  |                                     |
  | Match succeeds — attacker is       |
  | authenticated as the victim user    |

Key insight: The attacker never needs the plaintext password. They only need the NTLM hash, which they can obtain from:

• LSASS memory dump (Mimikatz sekurlsa::logonpasswords)
• SAM registry hive (lsadump::sam)
• DCSync attack (lsadump::dcsync)
• Credential theft tools (Invoke-Mimikatz, Rubeus, SharpKatz)

PtH Event IDs — What to Monitor

Primary Detection: Event ID 4624 (Successful Logon)

When PtH occurs, the logon event on the target system shows specific characteristics:

SPL query — detect PtH via logon type 3 from anomalous source (a critical insider threat indicator):

index=windows sourcetype=WinEventLog:Security EventCode=4624 LogonType=3
| search AccountName!="SYSTEM" AccountName!="ANONYMOUS LOGON" AccountName!="*$"
| iplocation IpAddress
| stats count, values(WorkstationName) as Workstations, values(Computer) as Servers, values(City) as Cities by AccountName, LogonGuid
| where mvcount(Workstations) > 1 OR mvcount(Cities) > 1
| eval alert = "POTENTIAL PtH — " . AccountName . " authenticated via network logon from multiple workstations"
| table _time, AccountName, Workstations, Servers, count, alert

Secondary Detection: Event ID 4776 (NTLM Authentication)

This event records every NTLM authentication attempt against a server and includes the workstation name:

SPL query — detect NTLM auth from unusual workstation:

index=windows sourcetype=WinEventLog:Security EventCode=4776
| search Status="0x0"
| stats count, values(Workstation) as Workstations by LogonAccount
| where mvcount(Workstations) > 3
| eval alert = "NTLM AUTH — " . LogonAccount . " authenticated from " . mvjoin(Workstations, ", ") . " — possible PtH lateral movement"
| table _time, LogonAccount, Workstations, count, alert

Tertiary Detection: Event ID 4648 (Explicit Credential Use)

When a tool like wmic.exe, psexec.exe, or Invoke-WmiMethod is used with explicit credentials, Event 4648 fires with the target server and account:

SPL query — detect explicit credential use to remote systems:

index=windows sourcetype=WinEventLog:Security EventCode=4648
| search SubjectUserSid!="S-1-5-18" (not SYSTEM)
| stats count, values(TargetServer) as Servers, values(SubjectUserName) as Users by ProcessName, TargetUserName
| where mvcount(Servers) > 2
| eval alert = "EXPLICIT CRED USE — " . TargetUserName . " used from " . mvjoin(Users, ", ") . " via " . ProcessName . " to " . mvjoin(Servers, ", ") . " — lateral movement"
| table _time, TargetUserName, Users, ProcessName, Servers, count, alert

Logon Type Reference for PtH Detection

Tools That Use Pass-the-Hash

SPL query — detect Impacket-style PtH tools:

index=windows sourcetype=WinEventLog:Security EventCode=4624 LogonType=3
| search AuthenticationPackageName="NTLM"
| stats count by WorkstationName, AccountName, TargetUserName, IpAddress
| where WorkstationName="-" (Impacket tools often leave workstation name blank)
| eval alert = "POTENTIAL IMPACKET PtH — blank workstation name for " . AccountName . " from " . IpAddress
| table _time, AccountName, IpAddress, TargetUserName, count, alert

PtH Triage — Investigation Workflow

Step 1: Confirm PtH vs. Normal Usage

Step 2: Determine the Source of the Hash

Step 3: Scope the Lateral Movement

Identify the initial compromised host
    │
    ├─ Check Event 4624 — where did the authentication originate?
    │   Look for Network logon type 3 events with the compromised account
    │
    ├─ Check Event 4776 — all NTLM authentication attempts
    │   Map every server the account authenticated to
    │
    ├─ Check Event 4648 — explicit credential usage
    │   Shows which tools were used to execute the PtH
    │
    └─ Check Sysmon Event 3 — network connections from the compromised host
        Map all outbound connections to discover additional compromised systems and [C2 infrastructure](/threats/command-and-control)

Step 4: Contain

1. Disable the compromised account — stop further PtH attempts
2. Isolate the compromised host — prevent additional hash extraction
3. Reset the compromised account’s password — the hash changes immediately
4. Rotate all service account passwords that the compromised account had access to
5. Assume all servers accessed during the PtH window are compromised — investigate each

Prevention

Related

• Kerberoasting — detection and response for T1558.003 techniques
• Active Directory Basics — covers the active directory basics concepts
• Credential Theft Incident Response — detection and response for T1558.001, T1003.001, T1134 techniques
• Mimikatz — detection and response for T1003 techniques

Sources

• MITRE ATT&CK T1550.002
• Microsoft — Mitigating PtH
• CrowdStrike — Pass-the-Hash Detection
• Microsoft — NTLM Blocking
• Microsoft — Windows Security Event 4624