Pass the hash (PtH) is a lateral movement technique on Windows where an adversary authenticates as a user without knowing the cleartext password. MITRE tracks it as T1550.002, part of Use Alternate Authentication Material.
How attackers use it
PtH skips the standard authentication steps that need a cleartext password and goes straight to the part that uses the password hash. The valid hashes are captured first, using a Credential Access technique. They are then used to authenticate as that user, on the local system or on remote ones.
MITRE also documents "overpass the hash", where a stolen hash is used to authenticate and also to create a valid Kerberos ticket. That ticket then feeds a Pass the Ticket attack, covered in a separate post in this series.
The practical lesson: a password policy does not help once a hash is stolen. What helps is limiting where a given hash works.
How to detect it
MITRE's detection strategy highlights NTLM Type 3 network logons that arrive without accompanying domain logon events, especially from lateral systems or through built-in administrative tools. It also looks for mismatches between the source user context and the system being accessed, and correlates logon session creation, NTLM authentication and process or service start to spot remote access without a typed password.
For overpass the hash, combine Kerberos ticket issuance with NTLM-based lateral movement.
How to reduce the risk
MITRE lists four mitigations.
- Privileged Account Management: limit credential overlap across systems, so one stolen credential does not open every door.
- Update Software: apply patch KB2871997 to Windows 7 and later to limit the default access of local administrator group accounts.
- User Account Control: enable the pass the hash mitigations that apply UAC restrictions to local accounts on network logons. The setting is the registry value
LocalAccountTokenFilterPolicyunderHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, also available through Group Policy. - User Account Management: do not allow a domain user to be in the local administrator group on multiple systems.
Check your own environment
A read-only check of the token filter policy on one Windows host.
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy
If the value is missing, the restriction is in its default state. If it is set to 1, remote local-account logons get a full administrator token, which is the opposite of what you want. Also list who is in the local Administrators group on a sample of servers and check for domain users who appear on many of them.
Quick check
Why does limiting credential overlap help against pass the hash?
A stolen hash only opens the systems where that account is valid. The fewer systems share an administrator credential, the smaller the blast radius.
Sources
- MITRE ATT&CK, Use Alternate Authentication Material: Pass the Hash: https://attack.mitre.org/techniques/T1550/002
