Pass the Hash
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. When performing PtH, valid password hashes for the account being used ...
BY SOURCE
PROCEDURES (7)
Auto-extracted: 3 detections for authentication monitoring
Auto-extracted: 1 detections for registry monitoring
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for pass the hash
Auto-extracted: 1 detections for lateral