Pass-the-Hash: NTLM credential theft tactics

Pass-the-Hash is an attack technique that allows an adversary to authenticate to a remote system using a stolen NTLM hash, without ever knowing the plaintext password. In Windows environments, NTLM authentication does not require the actual password. It only requires the hash derived from it. An attacker who extracts an NTLM hash from memory or from the SAM database can replay that hash directly against SMB, RDP (in some configurations), WMI, or other Windows services. This makes Pass-the-Hash particularly dangerous for lateral movement across a network. The attack exploits a fundamental design property of the NTLM challenge-response protocol: the hash itself serves as the authentication credential. It is not a flaw that can be simply patched away. It is inherent to how NTLM works. The technique was publicly documented as early as 1997 by Paul Ashton. It remains a core tactic in modern intrusion campaigns because Windows environments still rely heavily on NTLM fallback authentication. Domain environments running Kerberos are not immune either, as NTLM is often still enabled as a fallback. Privileged account hashes, especially those of Domain Admins, are the most sought-after targets. A single compromised hash can grant an attacker domain-wide access.

Detecting Pass-the-Hash attacks requires focused monitoring of Windows authentication events. The primary indicator is a Type 3 network logon (Event ID 4624, Logon Type 3) where the authentication package is NTLM rather than Kerberos. When Kerberos is available but NTLM is used instead, this is a strong signal worth investigating. Event ID 4776 captures NTLM authentication attempts against the local SAM database. Event ID 4625 logs failed authentication attempts, which can reveal brute-force or hash-replay patterns. A key behavioral indicator is an account authenticating from multiple hosts in a short timeframe using NTLM, especially if the source workstation name does not match the expected user environment. SIEM rules should flag NTLM authentications originating from service accounts or privileged accounts outside their normal operating hours or source IPs. Network-level detection should alert on SMB connections (port 445) initiating NTLM negotiation from unexpected hosts. Tools such as Microsoft Advanced Threat Analytics (ATA), Microsoft Defender for Identity, and Zeek-based network monitoring can correlate these signals effectively. Memory forensics using Volatility can reveal injected credentials or suspicious LSASS access patterns. Monitoring process access to lsass.exe via Event ID 4656 and Sysmon Event ID 10 (ProcessAccess targeting lsass) is essential to catch hash dumping before the lateral movement phase begins.

From a Red Team perspective, Pass-the-Hash execution typically begins with dumping NTLM hashes from LSASS memory or the SAM/NTDS.dit database. Mimikatz remains the most widely used tool, with its 'sekurlsa::logonpasswords' module extracting hashes directly from LSASS. Impacket's 'secretsdump.py' allows remote hash extraction over SMB when administrative credentials are already available. Once a hash is obtained, tools such as 'pth-winexe', 'CrackMapExec', or Impacket's 'psexec.py' and 'wmiexec.py' can authenticate to remote targets using the hash directly. CrackMapExec is particularly efficient for spraying a single hash across an entire subnet to identify valid targets. For mitigations, disabling NTLM entirely where Kerberos is available is the strongest control. Microsoft's Protected Users security group prevents NTLM authentication for member accounts and forces Kerberos. Enabling Credential Guard on Windows 10 and Server 2016 and later isolates LSASS in a virtualization-based security enclave, preventing hash extraction from memory. Restricting local administrator account reuse across workstations via LAPS (Local Administrator Password Solution) limits the blast radius of a single compromised hash. Network segmentation and SMB signing enforcement also reduce the exploitability of stolen hashes across the environment.