Use Alternate Authentication Material: Pass the Hash

The APT1 group is known to have used pass the hash.^[2]

APT28 has used pass the hash for lateral movement.^[3]

APT32 has used pass the hash for lateral movement.^[4]

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.^[5]

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.^[6]

BADHATCH can perform pass the hash on compromised machines with x64 versions.^[7]

Chimera has dumped password hashes for use in pass the hash authentication attacks.^[8]

Cobalt Strike can perform pass the hash.^[9]

CrackMapExec can pass the hash to authenticate via SMB.^[10]

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.^[11]

Empire can perform pass the hash attacks.^[12]

FIN13 has used the PowerShell utility Invoke-SMBExec to execute the pass the hash method for lateral movement within an compromised environment.^[13]

GALLIUM used dumped hashes to authenticate to other machines via pass the hash.^[14]

HOPLIGHT has been observed loading several APIs associated with Pass the Hash.^[15]

Kimsuky has used pass the hash for authentication to remote access software used in C2.^[16]

Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.^[17][18][19]

During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.^[20]

Pass-The-Hash Toolkit can perform pass the hash.^[2]

PoshC2 has a number of modules that leverage pass the hash for lateral movement.^[21]

Wizard Spider has used the Invoke-SMBExec PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.^[22]

Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.

Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group.^[23]

Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy.

Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons.^[24]

Do not allow a domain user to be in the local administrator group on multiple systems.