Unlike attacks that require cracking a password hash, Pass-the-Hash abuses the hash as authentication material. If the account and target system permit the authentication attempt, an attacker may use the compromised identity to access additional systems.

• Primary risk: Unauthorised authentication using stolen password hashes.

• Common targets: Windows endpoints, Active Directory environments and systems supporting NTLM.

• Potential impact: Lateral movement, unauthorised access and compromise of privileged accounts.

• Key investigation evidence: Windows Security logs, NTLM authentication events, endpoint telemetry and network logons.

• Primary defences: Restrict NTLM, reduce local administrator privileges, protect credential material and monitor unusual authentication patterns.

1. When a Password Is Not Required

Imagine an organisation where an employee's workstation is compromised. The attacker gains access to credential material stored or exposed on the machine.

The organisation assumes that its users' passwords remain protected because the attacker has not demonstrated knowledge of their plaintext passwords.

However, the attacker may have obtained a password hash that can be used in certain NTLM authentication scenarios. If the attacker can use that hash to authenticate to another machine, recovering the original password may not be necessary.

This is the principle behind Pass-the-Hash.

The attack exploits the way some authentication mechanisms use password-derived material. A stolen hash can become a stepping stone from one compromised system to another, especially when accounts have excessive permissions or share credentials across multiple machines.

For a SOC analyst, the important question is not simply whether a password hash was exposed. It is whether the credential material was subsequently used for unauthorised authentication and whether that activity enabled further access.

2. Understanding NTLM Authentication

NTLM is a Microsoft authentication protocol historically used in Windows environments. Although Kerberos is generally preferred for many Active Directory domain authentication scenarios, NTLM may remain enabled for compatibility with legacy applications, workgroups and certain network services.

NTLM challenge-response authentication involves several components:

1. A client requests authentication to a server.

2. The server issues a challenge.

3. The client generates a response using credential-derived material and the challenge.

4. The server validates the response through the applicable authentication process.

5. If validation succeeds, the server establishes the authenticated session.

In this process, the user's plaintext password does not ordinarily need to be transmitted directly across the network.

However, the NT password hash can play a role in generating the response. In some circumstances, an attacker who obtains the necessary hash material can use it to perform authentication without first cracking it.

NTLM hashes are not plaintext passwords

A password hash is a derived representation of a password. The NT hash is based on the MD4 hash of the password encoded as UTF-16LE.

Although hashing is intended to support authentication and credential verification, possession of an NT hash can be dangerous in environments where it can be reused for authentication.

An NT hash is not universally accepted as a credential by every protocol or authentication mechanism. Pass-the-Hash applies to specific authentication paths and depends on the target, account, protocol and security configuration.

3. How a Pass-the-Hash Attack Unfolds

A typical attack may progress through several stages.

Stage 1: Initial access

An attacker compromises an endpoint through phishing, exploitation, stolen credentials or another access method.

The initial compromise does not necessarily involve Pass-the-Hash itself.

Stage 2: Credential access

The attacker attempts to obtain credential material from the compromised environment.

Potential sources include exposed credential stores, memory accessible to the compromised process, insecure administrative practices or previously collected credential data.

Access to credential material is not guaranteed. Modern Windows security protections can make credential theft more difficult, depending on system configuration.

Stage 3: Hash acquisition

The attacker obtains an NT hash associated with a user or service account.

The security significance depends on the account's privileges, the systems where it can authenticate and whether the hash can be used through a supported authentication path.

Stage 4: Authentication to another system

The attacker attempts to authenticate to a remote Windows system using the compromised credential material.

Successful access depends on several factors, including:

• Whether the target accepts NTLM.

• Whether the account is permitted to log on remotely.

• Whether the account has access to the requested resource.

• Whether additional security controls block the activity.

Stage 5: Lateral movement

If authentication succeeds, the attacker may access remote administrative shares, services or management interfaces permitted to the account.

The attacker may then attempt to obtain additional credentials or access more systems.

Stage 6: Privilege expansion and follow-on activity

If the compromised identity has administrative privileges, the attacker may gain broader control over the target system.

Further actions might include accessing sensitive files, modifying configurations or attempting to compromise additional accounts.

These outcomes are not automatic. Each requires appropriate permissions and a viable attack path.

4. Why Active Directory Environments Are at Risk

Pass-the-Hash is especially important in organisations with Windows endpoints and centrally managed identities.

Several common security weaknesses can increase the potential impact.

Reused local administrator passwords

If multiple endpoints use the same local administrator password, compromising one machine may expose credential material associated with an account that has access to other systems.

The same password may produce the same NT hash, making reuse particularly dangerous in environments where the hash can be used for authentication.

Excessive administrative privileges

Users and service accounts sometimes have more privileges than their jobs require. If an attacker obtains credential material for a highly privileged account, the potential impact increases significantly.

Unnecessary NTLM usage

Legacy applications and compatibility requirements may leave NTLM enabled across systems that no longer need it.

A broader NTLM authentication surface creates more opportunities for misuse of compromised credential material.

Inadequate endpoint protection

If an attacker can access sensitive credential material from a compromised endpoint, the likelihood of credential abuse may increase.

Credential Guard, appropriately configured endpoint protections and restrictions on privileged access can reduce exposure, although no single control eliminates every credential theft technique.

Weak network segmentation

If workstation networks can connect freely to administrative services on other endpoints and servers, stolen credentials may be easier to use for lateral movement.

Restricting management traffic can limit the systems an attacker can reach, even when an account has been compromised.

5. Distinguishing Pass-the-Hash from Related Attacks

Credential attacks can produce similar-looking authentication activity. Accurate classification requires understanding what credential material was used and how authentication occurred.

TechniqueCore conceptKey distinctionPass-the-HashUses an obtained password hash to authenticate through a compatible mechanismThe plaintext password need not be recoveredPassword crackingAttempts to recover a password from a hash or other credential representationSeeks the original passwordPass-the-TicketReuses a stolen Kerberos ticketAbuses ticket-based authentication rather than an NT hashKerberoastingRequests service tickets and attempts to recover service-account passwords offlineTargets service-account credentials through KerberosNTLM relayForwards authentication exchanges to another serviceRelays authentication rather than necessarily possessing the user's password hashCredential stuffingAttempts known username-password pairs against authentication servicesUses recovered or reused plaintext credentials

These techniques can appear in the same incident. For example, an attacker might steal credential material, use it to authenticate to another system and then attempt to obtain Kerberos tickets or relay other authentication exchanges.

However, an unusual NTLM logon alone does not establish Pass-the-Hash. The technique may require endpoint evidence or other forensic information to confirm.

6. Investigating Pass-the-Hash in a SOC

Consider a hypothetical incident in which an endpoint detection platform reports suspicious remote authentication from a workstation. Windows logs show a successful network logon to another machine using NTLM, followed by access to an administrative share.

The SOC analyst must determine whether this represents normal administration, an application using legacy authentication or credential abuse.

Step 1: Identify the source and destination

Establish:

• The source hostname and IP address.

• The destination hostname and IP address.

• The account used for authentication.

• The authentication protocol.

• The timestamp and event sequence.

• Whether the source user or process normally connects to the destination.

Compare the activity with the organisation's approved administrative workflows.

A successful NTLM logon is not inherently malicious. Many legitimate systems still use NTLM for compatibility.

Step 2: Review Windows Security Event ID 4624

Event ID 4624 — An account was successfully logged on records successful logon activity.

For remote network authentication, review the logon type and available authentication details.

Useful fields include:

• Logon Type 3: Network logon.

• Target Account: The account that logged on.

• Source Network Address: The originating address, when available.

• Workstation Name: The source workstation, when available.

• Authentication Package: The mechanism reported for authentication, such as NTLM.

• Logon Process: The process or mechanism associated with the logon.

A Type 3 logon using NTLM may be consistent with Pass-the-Hash, but it does not prove that a hash was stolen or reused. Analysts should correlate it with additional evidence.

Step 3: Examine Event ID 4776

Event ID 4776 — The computer attempted to validate the credentials for an account records NTLM credential validation activity.

Review:

• The account name.

• The source workstation.

• The reported status code.

• The timing relative to successful or failed network logons.

Depending on the environment, credential validation may be recorded on the system responsible for validating the credentials, such as a domain controller for domain accounts.

Event 4776 does not by itself identify Pass-the-Hash. It helps establish the NTLM authentication context.

Step 4: Correlate remote access activity

Review the destination system's logs for activity following authentication.

Relevant evidence may include:

• Event ID 5140: A network share was accessed.

• Event ID 5145: A network share object was checked to see whether the client can be granted the desired access.

• Event ID 4672: Special privileges assigned to a new logon, where applicable.

• Event ID 4688: A new process was created, if process-creation auditing is enabled.

These events can help establish what happened after the logon. Their availability depends on audit policy, system configuration and the actions performed.

For example, a successful network logon followed by unexpected access to administrative shares and unusual process creation may justify deeper investigation.

Step 5: Review endpoint telemetry

Examine EDR data from the source system for signs of credential theft or suspicious process behaviour.

Investigate:

• Unexpected access to processes containing sensitive authentication material.

• Suspicious memory-access activity.

• Credential dumping alerts.

• Unusual use of administrative tools.

• Unexpected remote management activity.

• Processes initiating network connections to multiple endpoints.

Credential theft may occur before the authentication event, so the investigation window should include activity leading up to the suspicious logon.

Step 6: Establish the lateral movement path

Build a timeline showing the systems accessed by the account.

Determine whether the account authenticated to multiple hosts in a short period, accessed systems outside its normal scope or initiated remote administrative actions.

Check whether the same account or source endpoint was associated with additional authentication anomalies.

A sequence of successful network logons across several machines can indicate lateral movement, but it should be compared with legitimate software deployment, endpoint management and IT administration activity.

Step 7: Determine whether Pass-the-Hash is confirmed

Classify the evidence carefully:

• Suspicious NTLM activity: Unusual NTLM authentication is observed, but the use of stolen hash material is not established.

• Probable credential abuse: Authentication anomalies are supported by suspicious endpoint or lateral movement evidence.

• Confirmed Pass-the-Hash: Forensic evidence supports the use of stolen hash material in the authentication process.

If the available logs cannot distinguish Pass-the-Hash from other credential-abuse methods, document that limitation rather than overstate the conclusion.

7. Evidence and Indicators to Review

Pass-the-Hash does not have a single definitive Windows event ID. Investigation requires correlation across authentication, endpoint and network evidence.

Evidence sourceWhat to investigateWindows Security Event 4624Successful logons, logon type, authentication package and source addressWindows Security Event 4625Failed logons that may precede successful accessWindows Security Event 4776NTLM credential validation and status informationWindows Security Event 4672Special privileges associated with a logonWindows Security Events 5140 and 5145Network share access and access checksWindows Security Event 4688Process creation, when enabledDomain controller logsNTLM validation patterns and account authentication activityEDR telemetryCredential access, suspicious memory activity and remote executionFirewall and network logsConnections between workstations, servers and management servicesIdentity and asset inventoriesAccount privileges, normal access patterns and system ownership

Behavioural patterns that may warrant investigation

• An account authenticates to an unfamiliar workstation using NTLM.

• A user account accesses several endpoints in a short period without an established operational reason.

• A workstation begins connecting to administrative shares across multiple systems.

• NTLM logons occur shortly after suspicious credential-access activity.

• A compromised endpoint authenticates to servers outside its normal management scope.

• Successful authentication is followed by unexpected process creation or remote administration.

These are investigation leads rather than proof of Pass-the-Hash. Authentication behaviour must be interpreted in the context of the user's role, system configuration and normal administrative activity.

8. Detection Engineering and MITRE ATT&CK

A useful detection strategy combines NTLM authentication events with endpoint and lateral movement signals.

Example detection logic

1. Identify successful NTLM network logons to sensitive systems.

2. Compare the source host, account and destination against known administrative patterns.

3. Detect unusual authentication to multiple hosts within a short period.

4. Correlate the logons with credential-access alerts or suspicious process activity.

5. Enrich the event with account privilege, asset criticality and recent authentication history.

6. Escalate when independent evidence supports credential theft or lateral movement.

Avoid alerting on every NTLM logon. Legacy applications, file sharing and legitimate administrative activity can generate substantial NTLM traffic.

MITRE ATT&CK mapping

• T1550.002 — Pass the Hash: The specific technique for using a password hash to authenticate without knowing the plaintext password.

• T1003 — OS Credential Dumping: Relevant when evidence indicates that credentials or password hashes were extracted from an operating system.

• T1021 — Remote Services: Potentially relevant when the attacker uses remote services for lateral movement, depending on the service and evidence.

• T1078 — Valid Accounts: Potentially relevant when compromised account credentials are used to access systems.

These techniques describe different stages or behaviours. For example, credential dumping may precede Pass-the-Hash, but it is not required in every incident where the attacker obtains a hash by another means.

9. Preventing Pass-the-Hash Attacks

Effective prevention focuses on protecting credential material, reducing opportunities for hash reuse and restricting where accounts can authenticate.

Restrict NTLM where practical

Audit NTLM usage and identify applications that still depend on it. Migrate compatible workloads to Kerberos or other appropriate authentication mechanisms.

Use domain and local security policies to restrict NTLM carefully, testing compatibility before enforcing broad restrictions.

Reduce local administrator privilege

Avoid giving ordinary users local administrator rights. Limit privileged accounts to the systems and tasks that require them.

Use separate administrative accounts for administrative activities and prevent highly privileged accounts from routinely logging on to lower-trust endpoints.

Use Windows LAPS

Windows Local Administrator Password Solution (Windows LAPS) can manage and rotate local administrator passwords on supported Windows systems.

Unique, managed local administrator passwords reduce the risk that a single compromised local administrator credential can be reused across many machines.

Protect credential material

Where supported, enable and appropriately configure Windows Defender Credential Guard and other platform credential protections.

Maintain endpoint protection, restrict unnecessary administrative access and investigate attempts to access sensitive authentication processes.

These measures reduce exposure but do not eliminate all credential theft or authentication abuse.

Apply network segmentation

Restrict unnecessary connections between workstation networks, servers and administrative services.

Allow remote management only from approved management systems where practical. Segmentation can limit lateral movement even if an account is compromised.

Monitor authentication behaviour

Collect Windows authentication logs from endpoints and domain controllers. Establish baselines for account-to-host relationships, NTLM usage and remote administrative activity.

Investigate deviations in context rather than treating any single authentication event as conclusive.

Apply least privilege to service accounts

Review service account permissions, authentication requirements and interactive logon rights. Remove unnecessary privileges and use managed service identities where appropriate.

10. Incident Response Checklist

When Pass-the-Hash is suspected:

1. Preserve evidence: Collect Windows Security logs, EDR telemetry, domain controller records and network data.

2. Identify affected identities: Determine which account was used and what privileges it holds.

3. Map lateral movement: Identify the source system, destination systems and subsequent activity.

4. Contain compromised endpoints: Isolate affected machines when warranted, following incident-response procedures.

5. Protect credentials: Reset or rotate affected credentials as appropriate and review privileged accounts for exposure.

6. Review NTLM activity: Identify other systems that accepted suspicious authentication from the same source or account.

7. Investigate persistence and impact: Check for unauthorised services, scheduled tasks, account changes and suspicious process execution.

8. Remediate root causes: Reduce privilege, improve credential protection and restrict unnecessary NTLM usage.

9. Validate recovery: Confirm that suspicious authentication has stopped and monitor for renewed activity.

Conclusion

Pass-the-Hash demonstrates why protecting plaintext passwords alone is not sufficient. In environments that support compatible NTLM authentication, a stolen password hash may be enough to authenticate to another system without recovering the original password.

For SOC analysts, the central task is to distinguish ordinary NTLM activity from credential abuse by correlating authentication events with endpoint evidence, remote access and lateral movement patterns.

For defenders, the priority is to reduce hash exposure, restrict unnecessary NTLM authentication, eliminate shared local administrator passwords and limit the systems privileged accounts can access.

The key lesson: A password hash can be valuable authentication material, so protecting it is as important as protecting the password itself.

Further Reading

• MITRE ATT&CK — T1550.002: Pass the Hash

• Microsoft Learn — Windows authentication and NTLM

• Microsoft Learn — Windows Defender Credential Guard

• Microsoft Learn — Windows LAPS

• Microsoft Learn — Advanced security audit policy and Windows Security event logging