Pass-the-Hash Lateral Movement

Overview

Pass-the-Hash (PtH) lateral movement is a technique where adversaries use stolen hashed credentials to authenticate to remote systems without needing to know the plaintext password. This method enables attackers to move laterally within a network by leveraging existing authentication mechanisms, often bypassing traditional credential validation. It is commonly employed during the lateral movement phase to expand access and control across compromised environments.

Attack Objective

• Gain unauthorized access to additional systems by reusing hashed credentials
• Supports the Lateral Movement stage of the attack lifecycle
• Advances the attacker’s position by enabling stealthy, credential-based access to network resources without triggering password-based authentication alerts

How the Technique Works

Adversaries extract hashed credentials from compromised systems, typically from memory or local storage, and use these hashes to authenticate to other systems via protocols that accept NTLM or similar hash-based authentication. Instead of cracking or decrypting the hash, the attacker “passes” the hash directly to authenticate, effectively impersonating the legitimate user. This bypasses the need for plaintext passwords and exploits trust relationships within the network.

Common Methods & Variations

• Extraction of hashes from memory using credential dumping tools
• Use of Windows authentication protocols such as NTLM and SMB for hash reuse
• On-premises environments are the primary target, but cloud environments with legacy authentication can also be affected
• Living-off-the-land techniques leveraging built-in Windows utilities versus custom or third-party tools for hash extraction and reuse

Indicators of Compromise (IOCs)

• Unusual authentication events where NTLM hashes are used across multiple systems
• Logs showing authentication attempts with reused hashes or anomalous lateral logins
• Presence of credential dumping tool artifacts or suspicious process execution on endpoints
• Network traffic indicative of SMB or other protocol usage consistent with hash-based authentication

Detection Strategies

• Monitoring authentication logs from endpoints, domain controllers, and network devices for abnormal NTLM usage patterns
• Behavioral detection focusing on unusual lateral authentication attempts and access patterns
• Correlation of process execution and network authentication events to identify credential dumping and reuse

Mitigation & Prevention

• Implementing strong credential hygiene, including limiting the use of privileged accounts and enforcing least privilege
• Disabling or restricting NTLM authentication where possible and enforcing Kerberos authentication
• Use of multi-factor authentication (MFA) to reduce the effectiveness of hash reuse
• Network segmentation and restricting lateral movement paths
• Regular patching and hardening of systems to prevent credential dumping

Response Considerations

• Immediate containment by isolating affected systems and disabling compromised accounts
• Comprehensive investigation to identify the scope of hash theft and lateral movement
• Credential resets for affected accounts and review of privileged access
• Post-incident hardening including enhanced monitoring and implementation of mitigations to prevent recurrence

Related Techniques

• Credential Dumping – upstream technique to obtain hashed credentials
• Remote Service Session Hijacking – alternative lateral movement method
• Pass-the-Ticket – similar credential reuse technique using Kerberos tickets
• Account Manipulation – to maintain persistence and facilitate lateral movement

Mapping & References

• MITRE ATT&CK Tactic: Lateral Movement
• MITRE ATT&CK Technique: T1075 – Pass the Hash
• Public research and advisories from cybersecurity organizations on credential theft and lateral movement
• Incident reports detailing PtH usage in real-world attacks