December 28, 2025
Updated: October 29, 2026
How pass-the-hash attacks work, why they matter, and how to detect and stop them in Active Directory environments.
Mohammed Khalil
A single stolen password hash can be enough to move through a Windows network, because NTLM authentication proves knowledge of the hash rather than the password itself. Pass-the-hash (PtH) is the technique of using a captured NTLM hash to authenticate as a user without ever cracking it. It matters because it can turn one compromised workstation into access across many systems when local administrator passwords are shared or privileged accounts sign in widely. This guide explains how pass-the-hash works, how to detect it in Windows logs, and which controls limit it.
Pass-the-hash is a lateral movement technique used against Windows environments. MITRE ATT&CK defines it as adversaries using stolen password hashes to authenticate as a user without knowing the cleartext password, which bypasses normal access controls. It is catalogued as technique T1550.002 under the Lateral Movement tactic.
The attack needs a hash first. Pass-the-hash is therefore never the first step of an intrusion. It follows a separate credential-access step, such as reading credentials from memory on a machine the attacker already controls.
A pass-the-hash intrusion usually follows the same sequence, which is why defenders can break it at several points:
NTLM is a challenge-response protocol. The server sends a challenge, and the client proves it holds the account's secret by computing a response from the password hash. Because the hash is the secret, anyone who holds the hash can compute a valid response, whether or not they know the password. Kerberos works differently, but a related variant called overpass-the-hash uses a hash to request a Kerberos ticket, and MITRE notes that ticket can then enable pass-the-ticket.
Hashes are normally taken from the memory of the Local Security Authority Subsystem Service, the local account database, or the domain's directory database. Reading LSASS memory is the most common route, and our guide to LSASS dumping explains that step and how to detect it. Detecting credential access earlier gives defenders a chance to act before any hash is reused.
Pass-the-hash attack chain (MITRE ATT&CK T1550.002) and where each control acts. Control placement is DeepStrike's assessment.
The two techniques are related but abuse different protocols. The difference determines which controls and log sources apply.
Aspect | Pass-the-hash | Pass-the-ticket |
|---|---|---|
Stolen material | NTLM password hash | Kerberos ticket |
Protocol abused | NTLM | Kerberos |
MITRE ATT&CK ID | T1550.002 | T1550.003 |
Typical log signal | NTLM network logons (Event 4624, Logon Type 3) | Unusual Kerberos ticket use |
Key control | Credential protection, LAPS, NTLM reduction | Ticket protection, short lifetimes, monitoring |
Risk concentrates where one credential unlocks many systems, and stolen credentials are a recurring entry point; our compromised credential statistics cover the costs, trends, and defenses. Four situations stand out:
No single event proves pass-the-hash, so detection relies on combinations of signals. The most useful starting point is Windows Security Event 4624, which is generated on the computer that was accessed when a logon session is created.
For NTLM, Microsoft's field documentation lists the fields to examine:
MITRE's detection strategy for this technique looks for anomalous NTLM Logon Type 3 authentications that lack the domain logon events you would expect, especially from lateral systems or through built-in administrative tools. It also looks for mismatches between the user context on the source and the target system. These are good hunting hypotheses, but they produce false positives in environments that still rely on NTLM, so baseline normal activity first.
Multifactor authentication does not stop this technique on its own. A hash authenticates over NTLM without presenting a code or push approval, so MFA protects the sign-in flows that use it, not the NTLM path. That is why the controls below focus on protecting the credential and reducing NTLM.
No control eliminates the technique. The goal is to make hashes harder to steal, less useful when stolen, and easier to spot. These controls are listed in the order we usually recommend evaluating them.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Microsoft says malware running in the operating system with administrative privileges cannot extract secrets protected by VBS.
It is enabled by default on domain-joined, non-domain-controller systems that meet the requirements, starting with Windows 11 22H2 and Windows Server 2025, and the default enablement is without UEFI lock. It does not protect the Active Directory database or the local Security Accounts Manager, so it complements the controls below rather than replacing them.
Windows LAPS rotates and backs up the local administrator password for each device, so one compromised machine no longer unlocks the others. Microsoft lists protection against pass-the-hash and lateral-traversal attacks as a benefit, and the feature is available at no extra cost on supported Windows platforms. Coverage is the common failure: a few unmanaged servers can undo the benefit.
Members of the Protected Users group are blocked from authenticating with NTLM at the domain controller, and their credentials are not cached on the device. Microsoft cautions that service and computer accounts should never be added, and that highly privileged accounts should be added only after testing, because the restrictions can lock accounts out.
Reducing NTLM removes the protocol the technique depends on. Microsoft's Windows IT Pro Blog describes a three-phase plan: enhanced NTLM auditing to find remaining usage, fixes for common dependencies (IAKerb and Local KDC) expected in the second half of 2026, and network NTLM disabled by default in the next major Windows Server release and associated client releases, with explicit re-enablement through policy. Microsoft says the target is subject to change, and that NTLM is being disabled by default rather than removed. Start with auditing now.
Credential theft only matters if valuable credentials are present. Administrators should use dedicated administrative workstations and should not sign in to ordinary user devices with domain-wide accounts. This reflects widely used tiering practice and our professional judgment rather than a single standard, and it is typically the highest-effort change.
The controls differ in effort and in what they can break. The table below is DeepStrike's assessment for planning, not a vendor ranking.
Control | Main effect | What can break | Typical effort |
|---|---|---|---|
Windows LAPS | Ends reuse of local admin passwords | Scripts that assume a fixed password | Low to moderate |
Credential Guard | Protects hashes in memory on the host | Apps needing NTLMv1, unconstrained delegation, or similar | Moderate |
Protected Users | Blocks NTLM for members | Lockouts for accounts without AES keys or that need NTLM | Moderate |
NTLM auditing, then restriction | Removes the protocol | Legacy applications and file shares | High, phased |
Administrative tiering | Limits credential exposure | Admin workflows and habits | High |
Test only in environments you own or are authorized to assess. A defensive review should answer five questions: where local administrator passwords are shared, which privileged accounts sign in to which devices, how much NTLM traffic remains, whether Credential Guard and LAPS are actually active on the devices you think they are, and whether your detections fire when an authorized test reuses a credential.
A network penetration test can measure the real blast radius of one compromised host, which tells you whether a shared password or a broad service account would let an attacker move on.
A joint exercise between attackers and defenders also helps tune detections; our explainer on red team versus blue team shows how those roles work together.
If a detection fires, your incident response plan should say who investigates, which credentials are reset, and how the affected hosts are isolated.
For a broader adversary-emulation exercise that starts from a realistic foothold, see DeepStrike's red teaming service.
Public frameworks and credential-access tools can both extract hashes and reuse them, and many penetration testing suites include the capability. Defenders do not need tool names to detect the behavior, because the log patterns and the credential-access step are what matter.
Start with Event 4624 on the accessed computer. Look at NTLM network logons, the NTLM version and key length, and unusual source machines or accounts. Combine those with endpoint alerts for credential access and with identity monitoring for abnormal NTLM use.
Not by itself. A hash authenticates over NTLM without a second factor, so MFA protects the sign-in flows that require it rather than the NTLM path. Credential protection, unique local administrator passwords, and NTLM reduction address the technique directly.
Accounts whose credentials work on many systems: shared local administrator accounts, privileged domain accounts that sign in to workstations, and broad service accounts. The built-in local administrator is a frequent target when its password is reused.
The technique applies to services that accept NTLM, which are overwhelmingly Windows environments. A non-Windows system is exposed mainly when it proxies or relays NTLM to Windows targets.
Pass-the-hash reuses an NTLM hash, while pass-the-ticket reuses a Kerberos ticket. Both enable lateral movement, but they abuse different protocols and need different detections.
Pass-the-hash persists because NTLM treats the hash as the secret, and many networks still contain reused local passwords and widely used privileged accounts. The most effective response is layered: protect credentials on the host, eliminate shared local administrator passwords, restrict NTLM, and monitor for the log patterns that follow credential theft. Start by measuring where NTLM and shared credentials still exist, then remove them in order of impact. No control is a guarantee, so verify that each one is actually enforced.
If you want to know how far one compromised workstation could reach in your environment, you can discuss scope with DeepStrike's team.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
