T1550.002 Pass the Hash
Subtécnica de T1550 Use Alternate Authentication Material
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Hacktool Rulerhightest · windows
- Successful Overpass the Hash Attempthightest · windows
- Pass the Hash Activity 2mediumstable · windows
- NTLMv1 Logon Between Client and Servermediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.