Pass-the-hash

Windows stores password hashes in memory and on disk so users do not have to retype their password for every network resource. Because NTLM authentication is computed from the hash, not the password, an attacker who steals a hash can use it directly to log on to other machines. No cracking is required.

The hashes usually come from credential dumping on a compromised machine: reading the memory of the LSASS process, the local SAM database or cached domain credentials. The most valuable prize is the hash of an account that is a local administrator on many machines, or a domain administrator who once logged on to a workstation.

Example

An attacker compromises one workstation and dumps the hash of the built-in local Administrator account. The organization uses the same local administrator password on every workstation, so the attacker passes that hash to dozens of other machines over SMB and repeats the dump on each one until a domain administrator's credentials turn up.

Why it matters for a SOC analyst

Pass-the-hash is one of the most common lateral movement techniques in Windows networks. Look for one account authenticating with NTLM to many hosts in a short time, and for local administrator logons over the network. Unique local administrator passwords (Windows LAPS), Credential Guard and keeping privileged accounts off workstations take most of its power away.