What is it?
Pass-the-Hash abuses protocols that accept proof derived from an NTLM password hash. A stolen hash can authenticate to compatible remote services without cracking or knowing the original password.
How it works in plain English
Use this three-part model to understand the attack without memorizing a tool name.
The system accepts a credential, token, ticket, recovery decision, or identity assertion as proof of who the requester is.
The attacker obtains, guesses, forges, replays, or changes that authentication material.
Focus on how the identity was acquired, where it was used, what device and network context changed, and what happened immediately after success.
Worked example: how the sequence may look
An NTLM hash for a valid account.
Present the stolen hash through an NTLM exchange.
4624 Logon Type 3 with NTLM and 4776 validation events.
Baseline NTLM and investigate privileged network logons from rare sources.
If successful, the attacker may continue with Remote Services. This is a possibility, not a guaranteed next step.
This is a defensive learning scenario. Real incidents vary, and the listed outcome is only one possible path.
Why do attackers use it?
Move laterally with credential material recovered from a host.
Avoid the time and cost of cracking.
Reuse identical privileged local-account hashes across systems.
Access SMB and NTLM-capable management services.
Prerequisites
An NTLM hash for a valid account.
A target service that permits NTLM.
Network access and account rights on the target.
Often, administrative access on one host to obtain the hash.
Attack path possibilities
Attack chains are not fixed. These links show common possibilities to investigate before and after this behavior.
RDP, SMB, SSH, WinRM, VNC, or similar services are used to access remote systems.
T1543.003 Windows Service ExecutionA Windows service is created or modified to execute code.
T1003.006 DCSyncDirectory replication rights are abused to request domain password data.
T1486 RansomwareFiles or systems are encrypted or disrupted for extortion.
Step-by-step attack flow
Compromise an endpoint and obtain credential material.
Identify reachable systems and useful accounts.
Present the stolen hash through an NTLM exchange.
The target validates the response without plaintext.
Access shares, management services, or continue lateral movement.
MITRE ATT&CK mapping
ATT&CK is updated over time. Verify the live technique before operationalizing a detection.
Logs and artifacts
4624 Logon Type 3 with NTLM and 4776 validation events.
Remote service creation 7045/4697, tasks, WMI, SMB, or WinRM activity.
Suspicious access to LSASS or local security databases on the source.
Privileged logons from workstations that do not normally originate them.
Realistic log examples
These records use realistic field names and formats but synthetic organizations, users, addresses, and identifiers. A single event is not proof; correlate time, identity, source, target, and the resulting action.
Failed authentication; useful for guessing, spraying, exposed remote services, and account targeting.
2026-07-16T14:22:31Z EventID=4625 Computer=DC01.corp.example
TargetUserName=j.singh TargetDomainName=CORP LogonType=3
AuthenticationPackageName=NTLM WorkstationName=WKSTN-442
IpAddress=203.0.113.48 IpPort=51842
Status=0xC000006D SubStatus=0xC000006A FailureReason="Unknown user name or bad password"Baseline NTLM and investigate privileged network logons from rare sources.
Cloud sign-in context including identity, application, source, result, device, and conditional access.
2026-07-16T14:24:51Z UserPrincipalName=j.singh@corp.example
AppDisplayName="Office 365 Exchange Online" IPAddress=203.0.113.48
ResultType=50126 ResultDescription="Invalid username or password"
ClientAppUsed=Browser ConditionalAccessStatus=notApplied
DeviceDetail.operatingSystem=Windows Location=SGCorrelate credential dumping on one host with NTLM logons to another.
Remote authentication and PAM outcome with source address and account.
Jul 16 14:22:33 web02 sshd[24817]: Failed password for invalid user backup
from 203.0.113.48 port 51842 ssh2
Jul 16 14:22:37 web02 sshd[24817]: Failed password for deploy
from 203.0.113.48 port 51842 ssh2Detect local administrators authenticating to many hosts rapidly.
- Who or what identity acted?
- From which device, process, IP, or workload?
- What target and operation were involved?
- Did it fail, succeed, or change state?
- What correlated event happened immediately before and after?
Detection logic / SIEM queries
Baseline NTLM and investigate privileged network logons from rare sources.
Correlate credential dumping on one host with NTLM logons to another.
Detect local administrators authenticating to many hosts rapidly.
Monitor administrative shares and remote services after NTLM logons.
SecurityEvent
| where EventID == 4624 and LogonType == 3
| where AuthenticationPackageName =~ "NTLM"
| summarize Targets=dcount(Computer), TargetList=make_set(Computer, 20)
by Account, IpAddress, bin(TimeGenerated, 30m)
| where Targets >= 3Mitigations
Reduce and disable NTLM where compatibility permits.
Use Credential Guard and protected LSASS.
Deploy unique local administrator passwords with Windows LAPS.
Restrict administrative logon paths and segment management networks.
Keep privileged identities off lower-trust systems.
Real-world examples
It is a common Active Directory lateral-movement technique.
Ransomware operators have reused local administrator hashes across Windows fleets.
APT1 was documented using tooling capable of Pass-the-Hash.
Common questions
01What makes Pass-the-Hash possible?
A trust assumption fails: an identity, input, component, network message, user decision, or software relationship is accepted without enough verification.
02What should a defender collect first?
Start with logs closest to the decision point, then add identity, endpoint, network, and control-plane context.
03How should I study this attack?
Learn the concept, identify prerequisites, map observable steps, write a detection hypothesis, and validate it safely in a lab.