T1550.002 Pass the Hash
Sub-technique of T1550 Use Alternate Authentication Material
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Hacktool Rulerhightest · windows
- Successful Overpass the Hash Attempthightest · windows
- Pass the Hash Activity 2mediumstable · windows
- NTLMv1 Logon Between Client and Servermediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.