Understanding Pass-the-Hash Attacks

In network security, we often focus on password strength. However, for an attacker, a password is often just a middleman. If they can acquire a hashed credential, they can “pass” it to authenticate, bypassing the need to ever crack the original password.

How the Attack Progresses

A PtH attack turns a single compromised workstation into a launchpad for company-wide lateral movement:

• Foothold: Attackers enter via phishing or unpatched exploits.
• Escalation: To scrape hashes from protected memory (the LSASS process), the attacker must first gain local administrator rights.
• Movement: Using stolen hashes, the attacker impersonates the user to access remote servers or other workstations.
• The “Whale”: The ultimate goal is to find the hash of a Domain Admin who previously logged into a workstation, granting the attacker keys to the entire kingdom.

Enterprise Mitigation Strategies

Effective defense relies on breaking the chain of lateral movement:

• Tiered Administration: Enforce strict boundaries where Tier 0 (Domain Admins) credentials are never used on Tier 2 (workstations).
• Credential Guard: Utilize Windows virtualization-based security to isolate NTLM hashes.
• Protocol Restriction: Disable NTLM where possible and transition to Kerberos, which is significantly more resilient.
• LAPS Implementation: Use Microsoft’s Local Administrator Password Solution to ensure every machine has a unique, randomized local admin password.

What to Monitor

Security Operations Centers (SOC) should watch for these indicators of a PtH attempt:

• Anomalous Patterns: Successful logons (Event ID 4624) where the authentication package is NTLM, but there was no preceding interactive logon.
• Impossible Travel: A single account authenticating from multiple subnets in a short timeframe.
• Unusual Services: Sudden creation of new services or the use of tools like PsExec for remote command execution.