What is a pass-the-hash attack?
D2 · Threats · CompTIA Security+ SY0-701A pass-the-hash (PtH) attack uses a captured NTLM password hash to authenticate to a system without knowing the actual plaintext password. Since Windows NTLM authentication accepts the hash directly, cracking isn't required.
Tools used: Mimikatz, Metasploit.
Prevention: Credential Guard (isolates LSASS), disable NTLM where possible, use Kerberos, implement least privilege, monitor for lateral movement.
Tools used: Mimikatz, Metasploit.
Prevention: Credential Guard (isolates LSASS), disable NTLM where possible, use Kerberos, implement least privilege, monitor for lateral movement.
PtH is a lateral movement technique. The attacker dumps hashes from one machine and uses them to access others. This is why defending admin accounts is critical — their hashes give access everywhere.