What Is Pass-the-Hash?

Pass-the-Hash Mechanics

When Windows authenticates users, it does not store plaintext passwords — it stores NTLM hashes of passwords. During authentication, Windows sends the hash rather than the plaintext password to authenticate to network resources. Pass-the-Hash attacks steal these hashes from memory or from credential stores and use them directly for authentication, without needing to crack or know the underlying password.

NTLM hashes are extracted from LSASS (Local Security Authority Subsystem Service) memory using tools like Mimikatz, which has become ubiquitous in ransomware and nation-state operations because it provides reliable credential extraction from compromised Windows systems. Once a hash is extracted, it can be used to authenticate to any system that accepts NTLM authentication and where the account has access — enabling lateral movement across the network without the underlying password ever being cracked.

Defense Against Pass-the-Hash

Credential Guard is a Windows security feature that uses hardware-based virtualization to protect LSASS memory from extraction tools like Mimikatz. Credential Guard prevents the most common hash extraction technique when properly configured on supported hardware. Protected Users security group membership prevents accounts in the group from using NTLM authentication, requiring Kerberos, which is not vulnerable to classic Pass-the-Hash. Network segmentation limits what systems a compromised hash can reach. Local Administrator Password Solution — LAPS — ensures that local administrator accounts have unique, randomly generated passwords on each system, preventing a single compromised local admin hash from enabling lateral movement to every system in the environment.

Pass-the-Hash Defense Strategies

Disable NTLM Where Possible

NTLM is the protocol that pass-the-hash exploits. Microsoft has deprecated NTLM in favor of Kerberos for over a decade, but NTLM remains enabled by default in most environments for backward compatibility. Auditing NTLM usage and progressively disabling it in environments where it is not required eliminates the protocol-level attack surface.

Credential Guard

Microsoft Credential Guard is a Windows 10/11 feature that uses virtualization-based security to isolate NTLM hashes from access by malicious code, even with administrator privileges. Enabling Credential Guard on Windows 10/11 workstations is one of the most effective endpoint controls against pass-the-hash attacks.

Tiered Administration

The structural defense against pass-the-hash is preventing privileged credentials from being used on lower-tier systems where credential theft is most likely. Tier 0 (domain controllers, certificate authorities) administrative accounts should only authenticate on Tier 0 systems. Tier 1 (server) admin accounts should only authenticate on Tier 1 systems. Tier 2 (workstation) accounts should only authenticate on workstations. This prevents an attacker who compromises a workstation from harvesting credentials with broader privilege.

Related Reading

• Active Directory Security — the environment Pass-the-Hash exploits
• Kerberoasting — the Kerberos-specific cousin attack
• Privileged Access Management (PAM) — the structural defense against credential-reuse attacks

Frequently Asked Questions

What is the difference between Pass-the-Hash and password cracking?

Password cracking takes a hash and attempts to determine the underlying plaintext password through guessing or brute force. Pass-the-Hash skips the cracking step entirely — the attacker uses the hash directly for authentication without ever knowing the plaintext password. Because Windows authentication uses hashed credentials internally, the hash itself is the credential. An attacker with a valid hash can authenticate as the user even without ever learning the password.

What is Mimikatz?

Mimikatz is the open-source credential extraction tool that enables Pass-the-Hash, Pass-the-Ticket, and other credential reuse attacks. After an attacker achieves local administrative privileges on a Windows system, Mimikatz reads LSASS memory and extracts NTLM hashes, Kerberos tickets, and cached credentials for every user who has authenticated on that system. Mimikatz appears in virtually every publicly documented enterprise ransomware investigation — its detection signature is a high-confidence indicator of active ransomware staging.

Does Pass-the-Hash work against Kerberos?

Classic Pass-the-Hash exploits NTLM authentication and does not work against Kerberos directly. However, the related Pass-the-Ticket attack uses extracted Kerberos tickets to authenticate, achieving the same operational result. Organizations that have aggressively migrated to Kerberos-only authentication reduce their Pass-the-Hash attack surface but remain vulnerable to Pass-the-Ticket. Both attacks rely on the same credential extraction from LSASS memory.

What is Credential Guard?

Microsoft Credential Guard is a Windows 10/11 security feature that uses hardware-based virtualization to isolate NTLM hashes and Kerberos tickets from access by malicious code, even with administrator privileges. When Credential Guard is enabled, Mimikatz and similar tools cannot extract credentials from LSASS memory. Credential Guard requires modern hardware with virtualization support and is one of the most effective endpoint controls against Pass-the-Hash and Pass-the-Ticket attacks.

What is the Protected Users group?

The Protected Users security group in Active Directory provides additional protections for accounts assigned to it. Members cannot use NTLM authentication (forcing Kerberos), cannot use weaker encryption types like DES or RC4, and cannot have credentials cached on systems they authenticate to. Adding high-privilege accounts to Protected Users is a quick configuration change that significantly reduces credential theft risk for those accounts. The trade-off is that Protected Users membership can break legacy authentication scenarios that depend on NTLM.

How does LAPS help with Pass-the-Hash?

The Local Administrator Password Solution (LAPS) ensures that local administrator accounts on every workstation and server have unique, randomly generated passwords managed by Active Directory. Without LAPS, organizations typically use the same local administrator password across all systems — meaning an attacker who compromises one workstation and extracts the local admin hash can use Pass-the-Hash to authenticate to every other workstation in the environment. LAPS eliminates this lateral movement vector by ensuring each local admin credential only works on its specific system.

Can MFA prevent Pass-the-Hash?

Standard NTLM and Kerberos authentication do not natively support MFA — the hash itself is the credential, and MFA is not invoked during authentication. MFA at the application layer (Microsoft 365 sign-in, Okta, etc.) is independent of Windows authentication and does not prevent Pass-the-Hash within the Windows environment. Phishing-resistant MFA combined with Credential Guard and tiered administration is the effective defensive stack — each addresses a different attack stage.

Real-World Example: Mimikatz and Pass-the-Hash in Every Major Ransomware Campaign

Mimikatz, the open-source credential extraction tool that enables Pass-the-Hash, appears in virtually every publicly documented enterprise ransomware investigation. The tool is so ubiquitous that its detection signature is a high-confidence indicator of active ransomware staging. The 2021 Colonial Pipeline attack, the 2021 Kaseya VSA attack, and dozens of other major incidents all involved Mimikatz-based credential extraction followed by Pass-the-Hash lateral movement to spread ransomware across the victim environment.