Wiki › Techniques, Tactics & Procedures (TTPs) › Privilege Escalation › Pass-the-Hash for Privilege Escalation

Pass-the-Hash for Privilege Escalation

2 min read

Jump to:

Overview

Pass-the-Hash (PtH) is a credential theft technique used by adversaries to authenticate to remote systems by leveraging hashed password representations instead of plaintext credentials. It plays a critical role in privilege escalation and lateral movement within compromised environments, enabling attackers to gain elevated access without needing to crack or obtain cleartext passwords.

Attack Objective

Achieve unauthorized access and control over higher-privilege accounts
Supports Privilege Escalation, Lateral Movement, and Persistence stages of the attack lifecycle
Advances attacker position by enabling access to additional systems and sensitive resources through reuse of credential hashes

How the Technique Works

Pass-the-Hash exploits the way authentication protocols handle password hashes by capturing these hashes from a compromised system’s memory or storage and using them to authenticate to other systems. Instead of cracking the hash, attackers inject or replay the hash to impersonate the legitimate user, bypassing the need for plaintext passwords and exploiting trust relationships within the network.

Common Methods & Variations

Extraction of NTLM or LanMan hashes from memory, SAM database, or credential caches
Use of tools or native OS commands to inject hashes into authentication sessions
Variants targeting on-premises Active Directory environments, cloud identity services with legacy protocols, and endpoint systems
Living-off-the-land techniques leveraging built-in Windows utilities versus custom or third-party tools designed for hash manipulation

Indicators of Compromise (IOCs)

Unusual authentication events using NTLM hashes across multiple systems
Access attempts from systems or accounts inconsistent with normal user behavior
Presence of credential dumping tools or suspicious processes in endpoint logs
Authentication failures followed by successful logins with the same account on different hosts

Detection Strategies

Monitoring Windows Security Event Logs for anomalous NTLM authentication patterns
Behavioral detection focusing on unusual lateral authentication and privilege escalations
Correlation of credential dumping alerts with subsequent network authentication events

Mitigation & Prevention

Enforce the use of multifactor authentication and strong credential hygiene
Limit the use and storage of credentials in memory through security features like Credential Guard
Implement least privilege principles and restrict administrative account usage
Segment networks and restrict lateral movement paths to reduce exposure

Response Considerations

Immediately isolate affected systems to prevent further credential abuse
Conduct thorough credential and session audits to identify compromised accounts
Reset passwords and hashes for impacted accounts and enforce credential rotation
Apply endpoint hardening and update detection rules to prevent recurrence

Related Techniques

Credential Dumping – upstream technique for obtaining hashes
Overpass-the-Hash – alternative hash-based authentication abuse
Lateral Movement – subsequent use of stolen credentials to access additional systems
Persistence – maintaining access through compromised credentials

Mapping & References

MITRE ATT&CK Tactic: Privilege Escalation, Lateral Movement
MITRE ATT&CK Technique: T1075 (Pass the Hash)
Public research and advisories from cybersecurity vendors and incident response reports detailing PtH usage

Tags: Authentication credential theft Cybersecurity Detection Incident Response lateral movement Mitigation MITRE ATT&CK NTLM Pass-the-Hash privilege escalation