Pass-the-Hash: understanding and reducing the risk in Active Directory
Pass-the-Hash (PtH) is a lateral movement technique that, under certain conditions, makes it possible to authenticate with the NT hash of a password without knowing the cleartext password. In an Active Directory environment, the risk depends mainly on credential exposure on workstations, the privileges of the identity concerned and the reuse of those rights on other systems. MITRE ATT&CK classifies this technique as T1550.002.
PtH is not, on its own, a domain compromise. It can, however, turn the compromise of a workstation into progression towards other machines when privileged accounts have logged on to it, when their secrets are accessible or when the same privileges exist on several systems. The defensive priority is therefore to reduce opportunities for exposure and to break the trust relationships that make this progression possible.
Active Directory attack pathsWhy the NT hash remains sensitive
NTLM is a family of legacy authentication mechanisms still present in some Windows environments. An NT hash recovered in a compromised context can, depending on the protocol, the configuration and the associated rights, be reused without cracking the password. The risk increases when administration accounts log on to lower-trust workstations, when accounts hold extensive privileges on several systems or when NTLM remains enabled without an inventory of its uses.
Pass-the-Hash should not be confused with NTLM Relay. The former requires possessing a usable hash, whereas the latter consists of relaying an ongoing authentication exchange to another target. Exploitation conditions, protection mechanisms and detection strategies are therefore not the same.
Credential Guard protects certain authentication secrets by isolating them with virtualization-based security. This protection reduces the possibilities of extracting secrets on compatible systems, but does not protect secrets stored in the SAM database or in the Active Directory database. It replaces neither account segmentation, nor logon control, nor authentication monitoring.
Priority measures to reduce the risk
Separate uses and privileges. Use separate accounts for administration and day-to-day activities. Restrict logons by privileged accounts to the trusted systems intended for that purpose and prevent them from opening sessions on ordinary user workstations. Reduce standing privileges and local rights to the strict minimum.
Protect administration workstations and sessions. Deploy dedicated, hardened administration workstations for sensitive operations. Review where privileged accounts open sessions, then remove first the situations that expose high-level secrets on less protected machines.
Assess Credential Guard. Check the hardware prerequisites, Windows versions, application dependencies and effects on the protocols in use. After a representative pilot, enable the protection on compatible workstations and check its actual deployment status. Do not treat a configured policy as proof that the protection is actually active everywhere.
Reduce NTLM progressively. Start by inventorying and auditing uses, identify the applications and devices that depend on it, then address those dependencies before restricting flows. Disable NTLMv1 and reduce residual NTLM uses where compatibility allows. An unprepared global cut-off can interrupt legitimate services; each step must be tested and monitored.
Prevent secret reuse across machines. Remove obsolete accounts, limit shared local accounts and deploy Windows LAPS on compatible systems to manage distinct, regularly rotated local administrator passwords. Strong passwords remain necessary, but their complexity does not block the reuse of an already compromised hash. Controlling secrets and the associated privileges is a decisive protection.
Detecting abnormal use
Detection must correlate NTLM authentication events with the source and target systems, the logon type and the account's usual context. Look in particular for unusual network authentications by a privileged account, logons from a workstation where that account is not normally used, and rapid sequences across several hosts. These signals should be correlated with the available security logs and recent privilege changes.
MITRE ATT&CK provides detection strategy DET0409, focused in particular on analysing atypical NTLM network authentications, especially type 3 logons, and correlating them with other security events. Rules must be adapted to the organisation's normal operations: an isolated event does not by itself establish the use of PtH. The value comes from correlation, log coverage and the ability to trace quickly from the source workstation to the identity and the resources affected.
Controls to monitor
- Share of compatible workstations where Credential Guard is actually active.
- Privileged accounts detected on non-dedicated workstations and time to remediation.
- Coverage of local administrator accounts by Windows LAPS.
- Inventoried NTLM uses, unresolved dependencies and trend after each reduction step.
- Coverage and retention of the events needed to detect network authentications.
- Number of shared or obsolete local accounts still to be addressed.
The goal is not to target an isolated indicator, but to reduce the number of paths between an exposed identity and critical systems. A regular inventory of privileged sessions, NTLM flows and local rights makes it possible to prioritise the fixes that remove the most lateral movement opportunities.
To place this technique within an overall approach, see our page on securing Active Directory and attack paths. Ariovis also supports the analysis and remediation of environments through its Identity and Active Directory Security offering and its AD security diagnostic tool.