<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-pass-the-hash-attacks
description: >-
  Detect and respond to Pass-the-Hash (PtH) attacks where adversaries use
  stolen NTLM hashes to authenticate without knowing plaintext passwords.
  Covers Windows event log analysis, Sigma detection rules, honeypot accounts,
  and NTLM restriction policies.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - pass-the-hash
  - ntlm
  - credential-access
  - lateral-movement
  - windows-security
  - t1550.002
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1550.002"]
---

# Detecting Pass-the-Hash Attacks

## Overview

Pass-the-Hash (PtH) exploits Windows NTLM authentication by replaying captured
password hashes directly. Attackers extract hashes from LSASS memory, SAM
database, or Active Directory replication, then authenticate to remote services
without cracking the password. Detection focuses on anomalous NTLM logon
patterns, logon type mismatches, and credential hygiene monitoring.

MITRE ATT&CK: T1550.002 — Use Alternate Authentication Material: Pass the Hash

## Prerequisites

| Requirement | Install |
|---|---|
| Windows Event Forwarding | GPO-configured log collection |
| Sysmon v15+ | Enhanced process and logon telemetry |
| SIEM (Splunk/Sentinel/Elastic) | Log aggregation and correlation |
| Python 3.10+ | For agent tooling |
| sigma-cli | `pip install sigma-cli` |

## Key Concepts

### Attack Mechanics

```
1. Attacker dumps NTLM hash from compromised host
   → mimikatz: sekurlsa::logonpasswords
   → lsassy: lsassy -d corp.local -u admin -H <hash> 10.0.1.0/24

2. Attacker authenticates to remote host using hash
   → impacket-psexec -hashes :aad3b435b51404eeaad3b435b51404ee corp/admin@10.0.1.50
   → mimikatz: sekurlsa::pth /user:admin /domain:corp /ntlm:<hash>

3. Remote host validates NTLM response against DC
   → Logon appears legitimate — same SID, same permissions
```

### Detection Indicators

| Indicator | Event ID | Description |
|---|---|---|
| NTLM logon from unexpected source | 4624 (Type 3) | Logon with NtLmSsp, LogonProcessName = NtLmSsp |
| Logon type mismatch | 4624 | Network logon (Type 3) for interactive account |
| Hash used without prior interactive logon | 4624 + 4648 | No preceding Type 2/10 logon on source host |
| LSASS access | Sysmon EID 10 | Process accessing lsass.exe memory |
| Credential material in process | Sysmon EID 1 | sekurlsa, mimikatz, lsassy in command line |

### Sigma Detection Rules

#### Anomalous NTLM Network Logon

```yaml
title: Pass-the-Hash — NTLM Network Logon from Non-Standard Source
id: 7a2c8d4e-1b3f-4e5a-9c6d-2e8f7a1b3c5d
status: experimental
description: >
  Detects NTLM Type 3 logons where the source workstation does not match
  expected administrative jump hosts.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: NTLM
    LmPackageName: 'NTLM V2'
  filter_known_sources:
    WorkstationName|endswith:
      - '-ADMIN'
      - '-JUMP'
      - '-PAW'
  condition: selection and not filter_known_sources
falsepositives:
  - Legitimate NTLM authentication from newly provisioned hosts
  - Service accounts using NTLM for legacy application compatibility
level: high
tags:
  - attack.lateral_movement
  - attack.t1550.002
```

#### LSASS Memory Access

```yaml
title: Suspicious LSASS Memory Access for Credential Dumping
id: 3f1e9b2a-7c4d-4a8e-b5f6-1d2c3e4a5b6c
status: experimental
description: Detects processes accessing LSASS memory with suspicious access rights
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
      - '0x1fffff'
  filter_system:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\svchost.exe'
  condition: selection and not filter_system
falsepositives:
  - Endpoint detection and response agents
  - Windows Credential Guard operations
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
```

### Mitigation Strategies

| Control | Implementation |
|---|---|
| Credential Guard | Enable via GPO: `Computer\Policies\Admin Templates\System\Device Guard` |
| Restrict NTLM | GPO: `Network security: Restrict NTLM: Incoming NTLM traffic` = Deny All |
| Protected Users group | Add privileged accounts to Protected Users security group |
| PAW deployment | Tier-0 admin accounts only authenticate from Privileged Access Workstations |
| LAPS | Deploy Local Administrator Password Solution — unique password per host |
| Honeypot accounts | Create decoy admin accounts; alert on any authentication attempt |

### Splunk Detection Query

```spl
index=wineventlog EventCode=4624 LogonType=3
  AuthenticationPackageName=NTLM
| where NOT match(WorkstationName, "(?i)(ADMIN|JUMP|PAW)")
| stats count by TargetUserName, IpAddress, WorkstationName
| where count > 3
| sort -count
```

## Workflow

1. **Baseline** — Inventory legitimate NTLM usage across environment
2. **Deploy detection** — Import Sigma rules, configure SIEM alerts
3. **Monitor** — Watch for NTLM logon anomalies and LSASS access events
4. **Investigate** — Correlate source host, user, and timing of suspicious logons
5. **Contain** — Isolate compromised hosts, reset affected credentials
6. **Harden** — Deploy Credential Guard, restrict NTLM, implement PAW
7. **Validate** — Red team PtH attempts against hardened environment
8. **Tune** — Reduce false positives from legitimate NTLM dependencies

## Verification

| Check | Method |
|---|---|
| Event collection active | Verify EID 4624 flowing to SIEM from all domain controllers |
| Sigma rules deployed | `sigma check` passes on all PtH detection rules |
| NTLM audit enabled | GPO: `Network security: Restrict NTLM: Audit NTLM authentication` |
| Credential Guard active | `Get-CimInstance -ClassName Win32_DeviceGuard` — VBS running |
| Honeypot alerts work | Attempt logon with honeypot account — alert fires within 5 min |

## References

- [MITRE ATT&CK T1550.002](https://attack.mitre.org/techniques/T1550/002/)
- [Microsoft — Mitigating Pass-the-Hash](https://www.microsoft.com/en-us/download/details.aspx?id=36036)
- [CIS Benchmark — Windows Server 2022](https://www.cisecurity.org/benchmark/microsoft_windows_server)
- [NIST SP 800-63B — Authentication](https://pages.nist.gov/800-63-3/sp800-63b.html)
