tool
Pass-The-Hash Toolkit is a toolkit that allows an adversary to "pass" a password hash (without knowing the original password) to log in to systems. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Pass-The-Hash Toolkit can perform pass the hash.2
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
8th percentile · 92% of 825 ATT&CK software entries have more detection rules per technique.
16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
99th percentile · 99% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.
Technique Campaign use over its cumulative rule count.
6 distinct rules cover the 1 technique recorded for this tool. 6 Sigma.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
This events that are generated when using the hacktool Ruler by Sensepost | Generic | test | authentication | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2017-05-31 | 2022-10-09 | 24549159-ac1b-479c-8175-d42aea947cae | ||||
Detects logons using NTLM, which could be caused by a legacy source or attackers | Generic | test | - | windows | NTLM | - | low | Florian Roth (Nextron Systems) | 2018-06-08 | 2024-07-22 | 98c3bcf1-56f2-49dc-9d8d-c66cf190238b | ||||
Detects the reporting of NTLMv1 being used between a client and server. (...) | Generic | test | - | windows | WinEventLog System | - | medium | Tim Shelton, Nasreddine Bencherchali (Nextron Systems) | 2022-04-26 | 2023-06-06 | e9d4ab66-a532-4ef7-a502-66a9e4a34f5d | ||||
Detects the attack technique pass the hash which is used to move laterally inside the network | Generic | stable | authentication | windows | WinEventLog Security | - | medium | Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) | 2019-06-14 | 2022-10-05 | 8eef149c-bd26-49f2-9e5a-9b00e3af499b | ||||
Detects the attack technique pass the hash which is used to move laterally inside the network | Placeholder | test | authentication | windows | WinEventLog Security | - | medium | Ilias el Matani (rule), The Information Assurance Directorate at the NSA (method) | 2017-03-08 | 2023-12-15 | f8d98d6c-7a07-4d74-b064-dd4a3c244528 | ||||
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. | Generic | test | authentication | windows | WinEventLog Security | - | high | Roberto Rodriguez (source), Dominik Schaudel (rule) | 2018-02-12 | 2021-11-27 | 192a0330-c20b-4356-90b6-7b7049ae0b87 |