Pass-the-Hash (PtH)

PtH attacks target the NT LAN Manager (NTLM) challenge-response protocol. The core vulnerability is that NTLM authenticates a user by proving knowledge of the password hash, not the password itself. The system never verifies that the authenticating entity is the original user who created the hash. This allows an attacker to present a stolen LM hash or NT hash directly to a remote service's NtLmAuthenticate function, bypassing the need for plaintext credentials entirely.

Attackers must first obtain the hash, typically through local privilege escalation. Common extraction methods include:

• LSASS Memory Dumping: Using tools like Mimikatz to extract hashes from the Local Security Authority Subsystem Service process.
• SAM Database Extraction: Reading the Security Account Manager registry hive (C:\Windows\System32\config\SAM) offline.
• NTDS.dit Extraction: Compromising a Domain Controller to dump the Active Directory database containing every domain user's hash.
• Credential Dumping Tools: Leveraging built-in utilities like secretsdump.py from Impacket.

Once a hash is captured, the attacker uses it to impersonate the user across the network. This is executed via tools that modify the authentication process:

• Mimikatz: The sekurlsa::pth command injects the stolen hash into a new process, launching a command prompt that runs in the victim's security context.
• Impacket Suite: Python tools like psexec.py and wmiexec.py accept an -hashes flag, allowing remote code execution on a target server using only the LM:NT hash pair.
• PowerShell Remoting: Using Invoke-Command with explicit credentials derived from the hash to execute scripts on remote machines.

A direct evolution of PtH, Overpass-the-Hash converts the stolen NTLM hash into a full Kerberos Ticket Granting Ticket (TGT). This is achieved by using the hash to request a TGT from the Domain Controller's Key Distribution Center (KDC). The resulting Kerberos ticket provides access to any service the victim is authorized for, without triggering NTLM-specific detection rules. This technique is often executed via Mimikatz's sekurlsa::pth command combined with a klist purge and a new service access request.

PtH attacks are notoriously difficult to distinguish from legitimate authentication because they use valid, unmodified credentials. Standard event logs show a successful Event ID 4624 (Logon Type 3) with the correct username and domain. Key detection differentiators include:

• Logon Type Mismatch: A user authenticating from a workstation they have never physically logged into.
• NTLM Usage Anomalies: A sudden spike in NTLM authentication for a user who typically uses Kerberos.
• Missing Pre-authentication: The absence of a Kerberos TGT request (Event ID 4768) preceding the NTLM logon.

Effective mitigation requires breaking the attack chain at multiple points:

• Credential Guard: Enables Virtualization-Based Security (VBS) to isolate LSASS in a protected virtual container, preventing hash extraction even with kernel-level access.
• Restricted Admin Mode: Forces authentication via Kerberos and prevents the caching of plaintext credentials or reusable hashes on remote targets.
• Local Administrator Password Solution (LAPS): Ensures every workstation has a unique, randomized local administrator password, preventing lateral movement using a shared local account hash.
• Protected Users Security Group: A domain group that forces Kerberos-only authentication, disables NTLM, and prevents credential caching for its members.

A Windows privilege escalation technique where an attacker leverages the SeImpersonatePrivilege to assume the security context of another logged-on user.

• Commonly exploited via tools like Juicy Potato or PrintSpoofer
• Allows a service account (e.g., LOCAL SERVICE) to escalate to SYSTEM
• Distinct from PtH: it steals an active token rather than replaying a static hash
• Mitigated by restricting the impersonation privilege to only accounts that absolutely require it

A Virtualization-Based Security (VBS) feature in Windows that isolates the Local Security Authority (LSA) process in a protected virtualized container.

• Prevents attackers from extracting NTLM hashes and Kerberos tickets from memory
• Uses Hyper-V to create an isolated execution environment invisible to the host OS
• Effectively neuters Pass-the-Hash and Mimikatz-style credential dumping
• Requires hardware virtualization support (Intel VT-x or AMD-V)

An evolution of Pass-the-Hash where an attacker uses a stolen NTLM hash to request a full Kerberos Ticket Granting Ticket (TGT).

• Converts NTLM-based access into a Kerberos ticket for broader authentication
• Enables access to services that require Kerberos and reject NTLM
• Also known as Pass-the-Key when using AES keys instead of NTLM hashes
• Detected by monitoring for TGT requests without corresponding pre-authentication events

A persistence technique where an attacker compromises the KRBTGT account hash in Active Directory to forge arbitrary Kerberos TGTs.

• Grants unlimited domain access with arbitrary privileges and expiration
• Persists even after user password resets
• Requires Domain Admin-level access to extract the KRBTGT hash
• Mitigated by regularly resetting the KRBTGT password (twice to invalidate all existing tickets)

A targeted Kerberos attack where an attacker forges a Ticket Granting Service (TGS) ticket using the NTLM hash of a specific service account.

• Provides access to a single service rather than the entire domain
• Does not require Domain Admin privileges or KRBTGT compromise
• Harder to detect than Golden Tickets because TGS requests are common
• Mitigated by enforcing PAC validation and monitoring for anomalous service ticket requests