logo

Pass-the-Hash

Category:

Active Directory

Summary:

How pass-the-hash lets attackers authenticate with a stolen NTLM hash, how to detect the lateral movement, and how to contain it in a Windows domain.

Pass-the-Hash (PtH) is a lateral-movement technique in which an attacker authenticates to a Windows system using a stolen NTLM password hash instead of the plaintext password. Windows NTLM authentication treats the hash itself as the secret, so an attacker who dumps a hash from one machine can reuse it on others where the same account has rights — no cracking required. It is a core step in most Active Directory compromises and usually abuses SMB on port 445; its Kerberos-ticket equivalent is pass-the-ticket.

How It Works

When a user logs into a Windows host, a hash of their credentials is cached in memory (LSASS). An attacker with local admin on that host can extract the hash and present it to other systems over SMB or WMI. Because a local administrator password is frequently reused across many machines, one stolen hash can unlock an entire fleet — which is why flat networks fall so quickly once a single host is compromised.

How to Detect It

  • Watch for NTLM logons where Kerberos is expected, and Event ID 4624 logon type 3 originating from unusual workstations.
  • Correlate a single account authenticating to many machines in a short window — the classic lateral-movement pattern.
  • Monitor LSASS memory access by non-system processes (Sysmon Event ID 10), the usual precursor to hash theft.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

How to Defend Against It

  • Enforce unique local administrator passwords with Windows LAPS, so a stolen local hash can’t unlock other machines.
  • Enable Credential Guard to protect LSASS, and adopt a tiered admin model that restricts where privileged accounts can log on.
  • Add sensitive accounts to the Protected Users group to block NTLM, and keep domain admins off ordinary workstations.

Validating Your Defenses

An authorized penetration test confirms whether one compromised host lets an attacker move laterally across the domain, and how far it reaches. Record each host reached and the account used so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.