What Is a Pass-the-Hash Attack, and How Does It Work?

A stolen password hash can be just as valuable as the password itself. Pass the hash exploits reusable NTLM hashes to let attackers authenticate without ever knowing the user’s password.

Once an attacker has a single cached password hash from one compromised Windows machine, they can often authenticate as that user anywhere else on the network.

This guide breaks down:

• What pass the hash is
• Why NTLM makes it possible
• How the attack unfolds
• How to detect and prevent it in Active Directory
• How it differs from the related pass-the-ticket technique

What Is Pass the Hash?

Pass the hash is a credential-based attack technique in which an intruder reuses a stolen NT LAN Manager (NTLM) or LAN Manager (LM) password hash to log into a system or service. This bypasses the step of supplying the account’s actual plaintext password.

MITRE ATT&CK tracks it as sub-technique T1550.002 under “Use Alternate Authentication Material,” and describes it in two stages:

1. The attacker first captures a valid hash through a credential-access technique.
2. The attacker then replays that hash to authenticate as the compromised account.

The technique matters because it skips a step most people assume is required for authentication: knowing the password.

As long as the underlying hash validates, the target system has no way to tell the difference between the legitimate user and the attacker holding the stolen hash.

What Is an NTLM Hash, and Why Does It Enable Pass the Hash?

NTLM is a Windows challenge-response authentication protocol that proves a user knows a password without ever sending that password across the network.

Instead of the password, NTLM authentication relies on a hash derived from that password, which is cached locally and used to compute the response to the
server’s challenge.

The problem is that the hash itself is a reusable secret. NTLM never requires the plaintext password during authentication, only the hash. That means anyone who obtains the hash, by dumping it from memory, extracting it from disk or intercepting it in transit, can compute a valid response and authenticate as that user, with no need to reverse the hash back into a password.

Microsoft’s current guidance states Kerberos version 5 is the preferred authentication method for Active Directory environments and to retain NTLM only where legacy applications or workgroup configurations require it.

Every domain that still supportsNTLM, even as a fallback, keeps the reusable hash in play and keeps pass the hash on the table.

How Does a Pass-the-Hash Attack Work?

A typical pass-the-hash attack follows a predictable sequence once an attacker has a foothold on a single endpoint. The sequence looks like:

1. Initial compromise: The attacker gains code execution on a workstation or server, often through phishing, an exposed service or an unpatched vulnerability.
2. Credential dumping: The attacker extracts cached NTLM hashes from the Local Security Authority Subsystem Service (LSASS) process, the Security Accounts Manager (SAM) database or memory, frequently using a credential-dumping tool such as Mimikatz.
3. Hash reuse: The attacker injects the stolen hash into a new logon session, or uses it directly with the NTLM protocol, so the operating system treats the attacker’s session as if it belonged to the legitimate account holder.
4. Lateral movement: With a valid session, the attacker connects to other systems where that account has access, commonly over Server Message Block (SMB) or Windows Management Instrumentation (WMI), repeating the dump-and-reuse cycle on each new machine.
5. Privilege escalation: If any hash belongs to a domain administrator or service account with broad rights, the attacker can often reach the domain controller and take control of the entire Active Directory domain.

Every step after the first depends on the hash remaining valid and reusable. Limiting where privileged hashes can land is the key to containing the attack.

Who Is Vulnerable to Pass-the-Hash Attacks?

Any Windows environment that still relies on NTLM authentication, even as a fallback protocol, carries some pass-the-hash exposure. Risk increases sharply in a few common situations:

• Shared local administrator credentials: When the same local admin password is reused across many machines, one stolen hash unlocks all of them.
• Flat network permissions: Domains without tiered administration let a single compromised workstation lead directly to domain-level access.
• Legacy application dependencies: Older line-of-business applications that require NTLM keep the protocol enabled domain-wide, even for accounts that never touch those applications.
• Cached privileged sessions: Help desk and IT staff who log into end-user machines with elevated accounts leave privileged hashes sitting in memory on ordinary workstations.

Real-World Pass-the-Hash Attacks

Pass the hash remains one of the most common Active Directory attack techniques security teams encounter. It has shown up in some of the most damaging incidents on record, usually as the mechanism that turned a single infected machine into an organization-wide breach.

The 2017 NotPetya attack is one such example. The malware embedded a modified credential-dumping tool to harvest NTLM hashes and other cached credentials, then used those hashes alongside legitimate Windows administration tools to spread across corporate networks within minutes. A White House assessment later put the resulting damage at more than $10 billion worldwide, making it one of the costliest cyberattacks
on record.

The 2025 Poland Wiper attacks provide a recent example. According to MITRE ATT&CK, the adversaries attempted to reuse stolen password hash values to gain access to other systems as part of the intrusion.

Beyond ransomware operators, MITRE ATT&CK documents Mimikatz use across dozens of tracked threat groups, including activity involving pass-the-hash and pass-the-ticket techniques, spanning both financially motivated and state-sponsored actors.

Pass the Hash vs. Pass the Ticket

Pass the hash and pass the ticket are often confused because both let an attacker skip the plaintext password, but they target different authentication systems and require different defenses.

Pass the hash targets the password’s stand-in. Pass the ticket targets Kerberos’ stand-in. Both let an attacker skip the credential prompt entirely.

Pass the ticket abuses Kerberos rather than NTLM. Instead of reusing a password hash, the attacker steals a Kerberos ticket, either a service ticket that unlocks one specific resource or a ticket granting ticket (TGT) that can be used to request access to anything the compromised account can reach.

Attribute	Pass the Hash	Pass the Ticket
Protocol targeted	NTLM	Kerberos
Stolen material	Password hash	Service ticket or TGT
Typical scope	One account, replayed broadly	Scoped to the ticket’s issued permissions
Common tooling	Mimikatz, Impacket	Mimikatz, Rubeus
Primary defense	Restrict NTLM, isolate privileged hashes	Limit TGT lifetime, monitor ticket reuse

A related technique, overpass the hash, bridges the two: the attacker uses a stolen NTLM hash to request a legitimate Kerberos TGT, then operates entirely inside Kerberos from that point forward.

How Can You Detect a Pass-the-Hash Attack?

Detection centers on the gap between how a normal NTLM logon looks and how a replayed hash looks on the wire.

Through careful monitoring, you can detect unusual behavior patterns such as logins at odd times or from strange locations.

A standard network logon generates a Windows Event ID 4624 with Logon Type 3, which records the authentication package used for the session. Replayed hashes typically appear as Logon Type 3 events using the NTLM authentication package, and defenders can flag them by checking whether a legitimate interactive password logon ever preceded that session on the host.

Two other signals matter alongside logon telemetry:

• LSASS access monitoring: Endpoint detection tools that flag unusual process access to LSASS memory catch the credential-dumping step before the hash is ever reused.
• Anomalous logon patterns: A single account authenticating from many hosts in a short window, or a workstation account suddenly authenticating with domain administrator rights, is a strong lateral-movement indicator.

How Can You Prevent a Pass-the-Hash Attack?

Prevention comes down to reducing how many privileged hashes exist in memory, and how far any single stolen hash can reach. The image below gives an overview of how to prevent pass the hash.

Here are the best practices in detail:

• Enforce tiered administration: Keep domain and server administrator credentials off standard workstations entirely, so a compromised endpoint never has a privileged hash to dump.
• Randomize local administrator passwords: Use a solution such as Local Administrator Password Solution (LAPS) so a stolen local admin hash on one machine is worthless on every other machine.
• Deploy Credential Guard: Windows Defender Credential Guard uses virtualization-based security to isolate NTLM hashes and Kerberos TGTs in a protected process the operating system itself cannot read, blocking the credential-theft techniques used in pass-the-hash and pass-the-ticket attacks.
• Restrict NTLM where possible: Use Group Policy to block or audit NTLM traffic in segments of the domain that no longer need it, shrinking the pool of hashes an attacker can ever capture.
• Apply least privilege: Limit which accounts hold domain administrator rights and require just-in-time elevation instead of standing privileged access.

Beyond NTLM: Reducing Reliance on Reusable Password Secrets

Every defense above treats the same root cause: NTLM authentication depends on a reusable, password-derived secret that can be captured once and replayed indefinitely.

Kerberos improves on this with time-limited tickets, but even Kerberos environments that fall back to NTLM, or that get compromised through overpass-the-hash, still inherit that reusable-secret problem somewhere in the chain.

Pass the hash is a Windows and Active Directory lateral-movement problem. The fixes (tiered administration, Credential Guard, NTLM restriction) live in Active Directory and endpoint security tooling, not network authentication infrastructure. Nothing outside that stack stops an in-domain pass-the-hash attack once an endpoint is compromised.

The broader lesson applies past the domain boundary. Anywhere authentication relies on a shared, reusable secret, whether that is a password, an NTLM hash or a pre-shared key, that secret is a target for theft and replay.

For network and device authentication, certificate-based, passwordless authentication removes that reusable secret entirely: each device authenticates with a private key that never leaves the device and cannot be dumped from memory the way a password hash can.

The SecureW2 JoinNow Dynamic PKI issues and manages those certificates, and certificate-aware JoinNow Cloud RADIUS validates them at Wi-Fi, VPN and application access points, applying the same strategy at the network layer instead of the domain layer.

Strengthen Authentication Where It Counts

Tiered administration, Credential Guard, and NTLM restriction close the domain-side gaps pass the hash exploits.

Extending that same principle to 802.1X-based Wi-Fi and VPN authentication closes the network-side gap: certificate-based authentication removes the reusable secret before an attacker ever gets the chance to steal it.

If your organization is evaluating where passwordless authentication fits into that plan, schedule a demo to see how certificate-based authentication works in practice.

---

Frequently Asked Questions

How does a pass-the-hash attack work?

An attacker first gains code execution on an endpoint and extracts cached NTLM password hashes from memory or the local credential store. The attacker then injects or replays that hash to authenticate as the compromised user on other systems, moving laterally through the network without ever needing the plaintext password.

How do attackers obtain password hashes?

Attackers most often dump hashes from the LSASS process, the SAM database or Active Directory itself using credential-dumping tools such as Mimikatz. Hashes can also be captured by intercepting authentication traffic or by compromising a domain controller directly.

How can you detect a pass-the-hash attack?

Detecting a pass-the-hash attack involves identifying unusual behavior patterns through careful monitoring. Examples include logins from unusual locations or a high volume of authentication requests in a short period.

How can you prevent a pass-the-hash attack?

Keep privileged credentials off standard workstations through tiered administration, randomize local administrator passwords so one stolen hash does not unlock every machine, and deploy Credential Guard to isolate hashes from LSASS memory. Restricting NTLM where it is no longer needed further shrinks the pool of hashes available to steal.

What is the difference between pass-the-hash and pass-the-ticket?

Pass the hash reuses a stolen NTLM password hash, while pass the ticket reuses a stolen Kerberos service ticket or ticket granting ticket. Both let an attacker skip password authentication, but they exploit different protocols and require separate monitoring and defenses.