T1550.002Lateral MovementDefense Evasion

Pass the Hash

Once an attacker has an NTLM hash, they don't need to crack it, they authenticate with it directly. Here is the logon signature Pass-the-Hash leaves and the rules that catch it.

Run it live: Phishing to Lateral Movement

Dump a hash on the first workstation, pass it to reach the next host and the DC, and watch the NTLM network logons land in Wazuh.

Launch it

Windows NTLM authentication proves you know a password by proving you hold its hash, it never checks the plaintext. So an attacker who steals an NTLM hash (from LSASS, the SAM, or a captured challenge) can authenticate as that user without ever cracking it. This is Pass-the-Hash, and it is why 'we have strong passwords' is not a defense: the hash is as good as the password.

What it looks like

PtH produces a network logon (Event ID 4624, Logon Type 3) using NTLM authentication, often for a privileged account, from a host that account doesn't normally use. The tell is NTLM where you'd expect Kerberos (in a healthy domain, interactive admin access is Kerberos), plus a logon from an unusual source workstation.

Security EID 4624, Logon Type 3, Authentication Package NTLM (not Kerberos).
Often the account is a local or domain admin, and the source is a workstation, not a server.
Preceded by credential access (LSASS dump, see T1003.001) on the source host.
The same account authenticating to many hosts in a short window is spraying the hash around.

Detect it: Sigma

sigma / pass-the-hash-ntlm.yml

title: Pass-the-Hash via NTLM Network Logon
id: 0f1a2b3c-pth0-4d5e-6f70-tyrian000006
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
    LogonProcessName: 'NtLmSsp'
  filter_anonymous:
    TargetUserName: 'ANONYMOUS LOGON'
  filter_machine:
    TargetUserName|endswith: '$'
  condition: selection and not filter_anonymous and not filter_machine
level: medium
tags:
  - attack.lateral_movement
  - attack.t1550.002

This rule is noisier than the others, plenty of legacy apps still use NTLM, so run it as a hunt or correlate it with a preceding LSASS-access alert on the same host for a high-confidence chain. The gold is NTLM logon for an admin account right after a credential-dump alert.

Detect it: Wazuh (correlate with the LSASS rule)

wazuh / local_rules.xml

<group name="windows,lateral_movement,attack,">
  <rule id="100510" level="8">
    <if_group>windows_security</if_group>
    <field name="win.system.eventID">^4624$</field>
    <field name="win.eventdata.logonType">^3$</field>
    <field name="win.eventdata.authenticationPackageName">^NTLM$</field>
    <description>NTLM network logon (possible Pass-the-Hash, T1550.002)</description>
    <mitre>
      <id>T1550.002</id>
    </mitre>
  </rule>

  <!-- High confidence: NTLM logon shortly after an LSASS read (rule 100310) -->
  <rule id="100511" level="13" frequency="1" timeframe="300">
    <if_matched_sid>100310</if_matched_sid>
    <if_sid>100510</if_sid>
    <description>Pass-the-Hash chain: LSASS dump followed by NTLM logon</description>
    <mitre>
      <id>T1550.002</id>
      <id>T1003.001</id>
    </mitre>
  </rule>
</group>

Reduce the surface

LAPS, so a stolen local-admin hash opens one host, not all of them.
Restrict lateral admin logons; deny workstation-to-workstation admin authentication.
Disable NTLM where you can and monitor what breaks, most of it shouldn't need it.
Protect the source of the hash first (LSA Protection, Credential Guard).

In Tyrian's Phishing to Lateral Movement scenario you dump a hash on the first workstation and pass it to move deeper, so you can watch the NTLM logon (and the dump-then-logon correlation) fire in Wazuh.

Test this detection on your own SIEM

Launch the Phishing to Lateral Movement range, fire T1550.002, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques