T1550.002sub-technique of T1550 Use Alternate Authentication Material
Pass the Hash
Windows1 piece on this siteT1550.002 on attack.mitre.org
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
A domain admin logon from a workstation that has never had one
Twenty minutes. Is this lateral movement, a misconfiguration, or a backup job nobody documented? Name the three pieces of evidence that would settle it, and say what you would do if you could not get any of them.
how MITRE says to see it
Detection Strategy for T1550.002 - Pass the Hash (Windows)
- Detects anomalous NTLM LogonType 3 authentications that occur without accompanying domain logon events, especially from lateral systems or involving built-in administrative tools. Monitors for mismatches between source user context and system being accessed.
what reduces it
- M1052 User Account Control. Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy`. Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons.
- M1018 User Account Management. Do not allow a domain user to be in the local administrator group on multiple systems.
- M1026 Privileged Account Management. Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.
- M1051 Update Software. Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group.