A Pass-the-Hash attack is a Windows credential-based attack in which an attacker uses a stolen password hash to authenticate to another system without knowing the user’s actual password. The technique is particularly relevant to Active Directory environments because stolen NTLM credential material can sometimes be reused for lateral movement.
Unlike traditional password attacks, Pass-the-Hash does not require the attacker to recover the cleartext password first. If a captured hash can be used by the target authentication mechanism, the attacker may be able to authenticate using the hash itself.
MITRE ATT&CK identifies Pass the Hash as T1550.002, a sub-technique of Use Alternate Authentication Material under the Lateral Movement tactic.
This makes the technique especially important for organizations running Windows domains. A single compromised endpoint can potentially become a stepping stone toward additional systems when privileged credentials or reusable hashes are exposed.
What Is a Pass-the-Hash Attack?
A Pass-the-Hash attack occurs when an attacker uses a stolen password hash as authentication material instead of the original password.
The attacker does not necessarily need to crack the hash.
This distinction is important.
A password hash is not normally the same thing as the user’s plaintext password. However, certain Windows authentication mechanisms, particularly NTLM, use password-derived credential material during authentication. An attacker who obtains the appropriate hash may therefore be able to authenticate to systems that accept it.
Microsoft explains that NTLM uses a challenge-response authentication mechanism and that credentials involved in NTLM authentication are derived from the user’s password.
MITRE describes Pass the Hash as authenticating as a user without access to the cleartext password by using a stolen password hash.
Pass-the-Hash in Simple Terms
Consider an employee account:
CORP\john
John’s password is never directly known to the attacker.
However, malware running on John’s computer manages to obtain the NTLM hash associated with his account.
Instead of trying to discover John’s password, the attacker attempts to use the stolen hash as authentication material against another Windows system.
If the target accepts the authentication, the attacker may gain access with John’s privileges.
This is the basic idea behind Pass-the-Hash.
Why Is Pass-the-Hash Dangerous?
The main danger is that credential theft can become lateral movement.
An attacker who compromises one workstation may initially have limited access. If privileged credentials or reusable hashes are available on that machine, the attacker may attempt to move to other systems.
This creates a chain such as:
Initial compromise → Credential theft → Pass the Hash → Lateral movement → Privilege escalation → Domain compromise
MITRE categorizes Pass the Hash under Lateral Movement because attackers can use stolen password hashes to move between systems without knowing the associated plaintext password.
The risk becomes significantly higher when administrators use the same local administrator password across multiple computers or when highly privileged domain credentials are exposed on ordinary workstations.
How Does a Pass-the-Hash Attack Work?
A simplified Pass-the-Hash attack can be understood in several stages.
1. Initial System Compromise
The attacker first gains access to a Windows endpoint.
This can happen through many different techniques, including:
- Phishing
- Malicious documents
- Exploited vulnerabilities
- Malware
- Compromised remote-access credentials
- Drive-by compromise
- Supply-chain attacks
Pass-the-Hash is usually not the initial access technique.
It is more commonly used after an attacker has already established a foothold.
2. Credential Discovery
The attacker searches the compromised system for authentication material.
This may include:
- NTLM password hashes
- Cached credentials
- Authentication tokens
- Kerberos tickets
- Credentials associated with administrative sessions
Credential theft is an important prerequisite because Pass-the-Hash requires a usable password hash.
Microsoft notes that Credential Guard is specifically designed to protect secrets such as NTLM password hashes and Kerberos ticket-granting tickets from credential theft.
3. The Hash Is Reused
Once a suitable hash has been obtained, the attacker attempts to authenticate to another system.
The attacker does not need to type the user’s password.
Instead, the stolen credential material is used during the authentication process.
This is why Pass-the-Hash is fundamentally different from simply guessing passwords.
4. Lateral Movement
If authentication succeeds, the attacker may attempt to access another computer, server, or administrative service.
For example:
A compromised employee workstation contains credentials associated with a local administrator account.
The same local administrator password has been reused across 100 Windows systems.
The attacker obtains the credential material from one machine and attempts to use it against other systems.
If those systems accept the same credentials, the compromise can spread.
5. Privilege Escalation
The attacker may continue searching for accounts with higher privileges.
A common objective in an Active Directory attack is eventually obtaining control over highly privileged identities.
The more administrative privileges the compromised account has, the greater the potential impact.
Pass-the-Hash and NTLM
Understanding NTLM is important when studying Pass-the-Hash.
NTLM is a Windows authentication protocol based on a challenge-response mechanism. Microsoft states that Kerberos is the preferred authentication method for Active Directory environments, although NTLM remains supported for compatibility and other scenarios.
In simplified terms, NTLM authentication involves proving possession of password-derived credential material without transmitting the user’s plaintext password across the network.
That design is useful for authentication, but stolen credential material can create risk.
An attacker who obtains an appropriate NTLM hash may attempt to reuse it against services that support NTLM authentication.
This is one reason organizations should understand where NTLM is still being used and gradually reduce unnecessary NTLM dependency.
Pass-the-Hash vs Password Cracking
These two techniques are often confused.
They are not the same.
| Feature | Pass-the-Hash | Password Cracking |
|---|---|---|
| Requires password hash | Yes | Usually yes |
| Requires plaintext password | No | Goal is often to recover it |
| Main objective | Authenticate using hash | Recover password |
| Common use | Lateral movement | Credential recovery |
| Authentication attempt | Uses credential material | Usually uses recovered password |
| Depends on NTLM | Commonly | Not necessarily |
A major advantage for an attacker is that Pass-the-Hash can avoid the need to crack the password first.
For defenders, this means strong password policies alone are not enough.
Organizations also need to protect credential material on endpoints.
Pass-the-Hash vs Pass-the-Ticket
Pass-the-Hash and Pass-the-Ticket are related but different attacks.
Pass-the-Hash primarily abuses stolen password hashes, commonly in NTLM authentication scenarios.
Pass-the-Ticket abuses stolen Kerberos tickets.
MITRE tracks Pass the Hash as T1550.002 and Pass the Ticket as T1550.003. Both are sub-techniques of Use Alternate Authentication Material.
A simple way to remember the distinction is:
- Pass-the-Hash: stolen password hash
- Pass-the-Ticket: stolen Kerberos ticket
Both allow an attacker to bypass parts of the normal authentication process.
A Real-World Example
Imagine a company with 500 Windows computers.
Employees use domain accounts, while IT administrators maintain local administrator accounts for system management.
Several computers have the same local administrator password.
An attacker compromises one employee workstation through a phishing attack.
The malware executes and eventually obtains credential material from the compromised system.
The attacker discovers that the same administrative credentials are being reused on other machines.
Instead of trying to determine the plaintext password, the attacker attempts to reuse the available authentication material against another workstation.
The second machine accepts the authentication.
The attacker now has another system to investigate.
From there, additional credentials may be exposed, creating an expanding lateral-movement path.
This example illustrates why credential reuse is such a serious Active Directory security problem.
The original vulnerability was not necessarily a flaw in NTLM itself.
The larger problem was credential exposure combined with excessive credential reuse.
Common Causes of Pass-the-Hash Exposure
Several security practices can make Pass-the-Hash attacks easier.
Reusing Local Administrator Passwords
Using one local administrator password across many computers creates a major lateral-movement opportunity.
Modern Windows environments should use unique local administrator credentials.
Windows LAPS can help organizations manage local administrator passwords automatically.
Excessive Administrative Privileges
Users should not receive administrator privileges simply because an application requires them.
Administrative access should be limited to systems and tasks that genuinely require it.
Storing Credentials on Workstations
Administrative accounts should not routinely log in to lower-trust systems.
If a privileged account authenticates to a compromised workstation, its credential material may become a valuable target.
Poor Network Segmentation
Even if an attacker compromises one endpoint, network segmentation can limit where that system can communicate.
Flat networks make lateral movement easier.
Legacy NTLM Dependency
Organizations often retain NTLM because of older applications and compatibility requirements.
However, unnecessary NTLM usage increases the number of environments where NTLM-based credential attacks may remain relevant.
Microsoft recommends understanding NTLM usage and selectively restricting it as organizations move toward stronger authentication approaches.
How to Detect a Pass-the-Hash Attack
Detection requires more than looking for a single event.
Modern detection strategies correlate authentication activity with the source machine, account behavior, process execution, and network activity.
MITRE’s current Windows detection strategy for Pass the Hash focuses on anomalous NTLM Logon Type 3 authentication, particularly when it occurs without corresponding domain logon activity. It also recommends correlating authentication, logon-session, process, and network telemetry.
Windows Event ID 4624
Event ID 4624 records successful logons.
Security teams can investigate:
- Account name
- Source workstation
- Destination system
- Logon type
- Authentication package
- Source network address
An unusual NTLM network logon can be more interesting when it does not match the user’s normal behavior.
Event ID 4648
Event ID 4648 can provide information about logons where explicit credentials were used.
MITRE’s current detection strategy includes Event IDs 4624 and 4648 as useful telemetry for detecting suspicious authentication behavior.
Network Connections
Network telemetry can provide additional context.
For example, a workstation suddenly connecting to many Windows servers followed by unusual authentication activity may deserve investigation.
Process Creation
Process telemetry is also valuable.
A suspicious process initiating network connections and authentication attempts shortly after credential-related activity can strengthen the detection signal.
A SIEM or EDR platform can correlate these events to reduce false positives.
Indicators Security Teams Should Investigate
Security teams should pay particular attention to:
- Unusual NTLM authentication
- Multiple network logons from a workstation
- Administrative authentication from user endpoints
- Unexpected Logon Type 3 activity
- Authentication from systems the user normally does not access
- Sudden connections to multiple servers
- Privileged accounts authenticating to low-trust machines
- Suspicious processes associated with network authentication
- Credential-related alerts followed by lateral movement
No single indicator proves Pass-the-Hash.
The strongest detections come from combining multiple signals.
How to Prevent Pass-the-Hash Attacks
Effective prevention requires a layered approach.
1. Use Unique Local Administrator Passwords
Never rely on one shared local administrator password across an enterprise.
Windows LAPS can help automate local administrator password management and reduce the risk associated with password reuse.
2. Deploy Microsoft Defender Credential Guard
Credential Guard uses virtualization-based security to isolate sensitive credential information.
Microsoft states that Credential Guard protects NTLM password hashes, Kerberos TGTs, and other credentials and helps protect against credential theft techniques such as Pass-the-Hash and Pass-the-Ticket.
Organizations should evaluate compatibility and deployment requirements before enabling security controls across large environments.
3. Reduce NTLM Usage
Kerberos should generally be preferred in Active Directory environments where possible.
Microsoft notes that NTLM remains available for compatibility, but organizations can investigate where it is being used and selectively restrict NTLM traffic.
Do not blindly disable NTLM without first identifying applications and systems that depend on it.
4. Apply Least Privilege
Users and service accounts should receive only the permissions they require.
Avoid giving ordinary accounts administrative rights across multiple systems.
MITRE recommends reducing credential overlap between systems and avoiding situations where one domain user becomes a local administrator across many computers.
5. Protect Privileged Accounts
Privileged accounts deserve stronger controls.
Administrators should avoid using highly privileged domain accounts to perform routine tasks on low-trust workstations.
A compromised endpoint should not automatically expose the credentials of a domain administrator.
6. Segment the Network
Network segmentation can reduce the attacker’s ability to move between systems.
Separate:
- User workstations
- Servers
- Domain Controllers
- Administrative systems
- Critical applications
- Management networks
Access between segments should be based on business requirements.
7. Use Strong Endpoint Protection
Endpoint security products can detect suspicious credential access, malicious processes, and abnormal authentication behavior.
Security teams should ensure that EDR telemetry is available from important endpoints and servers.
8. Enable SMB Signing Where Appropriate
SMB signing provides integrity protections for SMB communications and can help mitigate certain attack scenarios.
CISA’s ransomware guidance recommends requiring SMB signing where SMB encryption is not enabled and notes that this can prevent certain adversary-in-the-middle and Pass-the-Hash attacks.
Organizations should test SMB signing requirements against legacy applications before enforcing them broadly.
Security Best Practices Checklist
Use this checklist when assessing a Windows Active Directory environment:
- Identify where NTLM is still being used.
- Remove unnecessary administrator privileges.
- Use unique local administrator passwords.
- Deploy Windows LAPS where appropriate.
- Protect privileged accounts.
- Avoid administrative logons to low-trust workstations.
- Enable Credential Guard where supported.
- Monitor NTLM authentication activity.
- Monitor Event ID 4624.
- Monitor Event ID 4648.
- Correlate authentication with process and network activity.
- Segment critical systems.
- Require SMB signing where appropriate.
- Review local administrator group membership.
- Regularly assess credential exposure.
- Test detection controls through authorized security assessments.
Tools Used in Pass-the-Hash Assessments
Security professionals may encounter several tools during authorized Active Directory assessments.
Mimikatz
Mimikatz is widely known for Windows credential and authentication research. MITRE documents its capabilities in relation to Pass the Hash, including functionality that can use password hashes for authentication.
Cobalt Strike
Cobalt Strike has also been associated with Pass-the-Hash capabilities in MITRE ATT&CK’s software catalog.
Impacket and Other Security Frameworks
Security assessment frameworks may contain functionality for interacting with Windows authentication protocols and testing lateral-movement controls.
These tools should only be used in environments where the tester has explicit authorization.
The goal of a professional penetration test is not simply to demonstrate that an attack works. It should also determine why the attack was possible, what systems were exposed, and how the organization can reduce the risk.
For people building practical skills, hands-on labs can provide a controlled environment for learning Active Directory security concepts.
Pass-the-Hash in Penetration Testing
During an authorized penetration test, Pass-the-Hash can help demonstrate the consequences of credential exposure.
A tester may evaluate:
- Whether credential material can be exposed from endpoints.
- Whether local administrator passwords are reused.
- Whether privileged credentials are present on ordinary workstations.
- Whether NTLM is unnecessarily enabled.
- Whether lateral movement is restricted.
- Whether security monitoring detects suspicious authentication.
- Whether endpoint security blocks credential theft.
- Whether compromised credentials can reach critical systems.
The final report should connect the technical finding to business impact.
For example, “NTLM is enabled” is not necessarily a useful risk statement by itself.
A stronger finding might explain that an attacker who compromises a workstation can potentially reuse exposed credential material to authenticate to multiple servers because administrative credentials are shared across systems.
That gives defenders a clear remediation path.
How Organizations Can Build Better Defenses
Preventing Pass-the-Hash is not about relying on one security product.
It requires a combination of identity security and endpoint security.
A mature environment should have:
Strong identity controls
→ Unique credentials and least privilege.
Protected endpoints
→ Credential Guard, EDR, secure configuration, and limited administrative access.
Reduced legacy authentication
→ Minimize NTLM dependencies where practical.
Network controls
→ Segmentation and restricted administrative paths.
Security monitoring
→ Centralized authentication and endpoint telemetry.
Continuous testing
→ Regular assessments that validate whether defensive controls actually work.
Organizations can also use professional VAPT services to evaluate authentication security, credential exposure, and lateral-movement risks.
Career Opportunities in Active Directory Security
Understanding Pass-the-Hash is valuable for several cybersecurity roles.
Penetration Tester
Penetration testers need to understand Windows authentication, credential theft, privilege escalation, and lateral movement.
Red Team Operator
Red teams use identity-focused attack simulations to determine whether an organization can detect and stop realistic intrusion paths.
SOC Analyst
SOC analysts investigate authentication anomalies and correlate endpoint and network events to identify lateral movement.
Threat Hunter
Threat hunters proactively search for suspicious authentication patterns that may not trigger conventional alerts.
Active Directory Administrator
Identity administrators are responsible for reducing credential exposure, managing privileges, and maintaining secure Windows domain configurations.
Building these skills through cyber security training and practical lab environments can help security professionals understand both offensive techniques and defensive controls.
Future of Pass-the-Hash Defense
Pass-the-Hash remains relevant because Windows environments continue to contain legacy applications, authentication dependencies, and valuable credential material.
At the same time, Microsoft is continuing to strengthen credential protection through technologies such as Credential Guard and virtualization-based security.
Microsoft’s current security documentation describes Credential Guard as a mechanism for isolating sensitive credentials from the normal operating system environment.
The long-term direction is clear: organizations should reduce reliance on legacy authentication, protect credential material at the endpoint, minimize privilege, and make lateral movement harder.
Security teams should also expect attackers to combine multiple identity techniques rather than relying on Pass-the-Hash alone.
Frequently Asked Questions
What is a Pass-the-Hash attack?
A Pass-the-Hash attack is a technique where an attacker uses a stolen password hash to authenticate to a Windows system without knowing the associated plaintext password. MITRE ATT&CK identifies it as T1550.002.
Does Pass-the-Hash require the attacker to know the password?
No. The defining characteristic of Pass-the-Hash is that the attacker uses stolen password-derived authentication material instead of the cleartext password.
Is Pass-the-Hash the same as password cracking?
No. Password cracking attempts to recover a password from credential material. Pass-the-Hash attempts to use the stolen hash directly for authentication.
Is Pass-the-Hash still possible in modern Windows environments?
The risk has been reduced by modern Windows security controls, but it remains relevant where NTLM is enabled, credential material is exposed, or administrative credentials are reused. Microsoft continues to provide protections such as Credential Guard to help protect credential material.
How can organizations prevent Pass-the-Hash attacks?
Organizations should use unique local administrator passwords, reduce NTLM usage where practical, deploy Credential Guard on supported systems, apply least privilege, protect privileged accounts, segment networks, and monitor authentication activity.
Which Windows events help detect Pass-the-Hash?
Event ID 4624 is particularly useful for investigating successful logons. Event ID 4648 can provide additional context for explicit credential use. MITRE’s current detection strategy also recommends correlating these events with process and network telemetry.
Can Microsoft Credential Guard prevent Pass-the-Hash?
Credential Guard protects sensitive credential material, including NTLM password hashes, using virtualization-based security. Microsoft specifically describes it as a protection against credential theft techniques such as Pass-the-Hash.
What is the difference between Pass-the-Hash and Pass-the-Ticket?
Pass-the-Hash uses stolen password hashes as authentication material, while Pass-the-Ticket uses stolen Kerberos tickets. MITRE tracks them as T1550.002 and T1550.003 respectively.
Conclusion
A Pass-the-Hash attack shows why protecting passwords alone is not enough in a Windows enterprise.
If an attacker obtains reusable credential material, they may be able to authenticate to other systems without ever discovering the user’s actual password. In a poorly segmented Active Directory environment, that can turn one compromised workstation into a path toward critical servers and privileged accounts.
The strongest defense is layered.
Organizations should reduce unnecessary NTLM usage, protect credentials on endpoints, use unique local administrator passwords, apply least privilege, protect privileged accounts, segment networks, monitor authentication events, and regularly test their defenses.
Pass-the-Hash is also a good example of why identity security and endpoint security cannot be treated as separate problems. A secure Active Directory environment depends on both.
For cybersecurity professionals, understanding this technique provides a strong foundation for learning Windows authentication, Active Directory security, lateral movement, threat hunting, and penetration testing.
To build practical skills, explore cyber security labs and online cyber security courses. Organizations can also explore security consulting and authorized VAPT assessments to identify weaknesses before attackers do.
