Techniques › T1550 › T1550.002
T1550.002 Pass the Hash
lateral movement — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
6
Sigma rules tagged attack.t1550.002
4
KEV CVEs mapped here
<p>Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.</p><p>When performing PtH, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.</p><p>Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform Pass the Ticket attacks.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | primary impact | Mapped | 2025-03-10 |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | primary impact | Mapped | 2025-03-10 |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | primary impact | Mapped | 2025-03-10 |
| CVE-2023-23397 | Microsoft Office | primary impact | Mapped | 2023-03-14 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0409 Detection Strategy for T1550.002 - Pass the Hash (Windows) v1.0
AN1144 WindowsDetects anomalous NTLM LogonType 3 authentications that occur without accompanying domain logon events, especially from lateral systems or involving built-in administrative tools. Monitors for mismatches between source user context and system being accessed. Correlates LogonSession creation, NTLM authentications, and process/service initiation to identify suspicious use of stolen password hashes for remote access or service logon without password entry. Detects overpass-the-hash by combining Kerberos ticket issuance with NTLM-based lateral movement.Tunable:
TimeWindowSourceAccountAnomalyThresholdLogonTypeFilter
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1550.002
Author: Roberto Rodriguez (source), Dominik Schaudel (rule)
· 2018-02-12 (modified 2021-11-27) · logsource: product=windows service=security · 192a0330-c20b-4356-90b6-7b7049ae0b87
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)
· 2019-06-14 (modified 2022-10-05) · logsource: product=windows service=security · 8eef149c-bd26-49f2-9e5a-9b00e3af499b
Detects the attack technique pass the hash which is used to move laterally inside the network
Author: Florian Roth (Nextron Systems)
· 2018-06-08 (modified 2024-07-22) · logsource: product=windows service=ntlm · 98c3bcf1-56f2-49dc-9d8d-c66cf190238b
Detects logons using NTLM, which could be caused by a legacy source or attackers
Author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
· 2022-04-26 (modified 2023-06-06) · logsource: product=windows service=system · e9d4ab66-a532-4ef7-a502-66a9e4a34f5d
Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.
Author: Ilias el Matani (rule), The Information Assurance Directorate at the NSA (method)
· 2017-03-08 (modified 2023-12-15) · logsource: product=windows service=security · f8d98d6c-7a07-4d74-b064-dd4a3c244528
Detects the attack technique pass the hash which is used to move laterally inside the network
Rules tagged at the parent level (attack.t1550) 5
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 905d389b-b853-46d0-9d3d-dea0d3a3cd49
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b45ab1d2-712f-4f01-a751-df3826969807
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Author: Max Altgelt (Nextron Systems)
· 2022-04-06 · logsource: product=windows service=security · def8b624-e08f-4ae1-8612-1ba21190da6b
Detects logon events that specify new credentials
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.