---
name: rt-scenario-n004
description: "N-004: Hash reuse and pass-the-hash risk assessment. Domain: network. Authorized scenario for evaluating credential hygiene, lateral movement controls, SMB protections, and remediation."
---

# N-004: Hash Reuse and Lateral Movement Risk

## Overview

This scenario assesses whether credential material from one host could enable access to other hosts due to local admin reuse, weak endpoint protections, missing SMB signing, or insufficient segmentation. Production credential use requires explicit authorization.

| Field | Value |
|---|---|
| Domain | Network / Windows |
| Objective | Evaluate lateral movement risk from credential reuse |
| Required Access | Compromised test host or client-provided evidence |
| Detection Risk | Medium |
| Primary Impact | Lateral movement and sensitive data access |

## Prerequisites

- Host scope approved.
- Credential testing rules approved.
- Test credentials or lab evidence preferred.
- SOC notification completed where required.
- Cleanup and reporting process defined.

## Attack Chain Model

1. Initial endpoint access exposes credential material or local admin context.
2. Same credential or hash works on other hosts.
3. Attacker reaches file servers, admin servers, or management tools.
4. Sensitive data or broader administrative access becomes available.

## Safe Validation Workflow

### Step 1 - Control Review

Review:

- Windows LAPS coverage.
- Credential Guard.
- LSASS protection.
- Local admin group membership.
- SMB signing.
- Admin tiering.
- Remote administration restrictions.

### Step 2 - Reuse Analysis

Prefer client-provided configuration or test credentials. Build a matrix:

| Credential Class | Reused? | Host Count | Business Risk |
|---|---|---:|---|
| Local admin | [yes/no] | [count] | [risk] |
| Service account | [yes/no] | [count] | [risk] |

### Step 3 - Segmentation and Access Review

Map which host classes can authenticate to which network zones.

### Step 4 - Impact Statement

State what a real attacker could reach if one endpoint is compromised.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Credential Use | Lateral Movement | Pass the Hash |
| Remote Access | Lateral Movement | SMB/Windows Admin Shares |
| Collection | Collection | Data from Network Shared Drive |

## Evidence

- LAPS coverage export.
- Local admin inventory.
- SMB signing status.
- Test credential validation result if approved.
- Network path matrix.

## Remediation

- Deploy Windows LAPS.
- Remove shared local admins.
- Enforce SMB signing.
- Enable Credential Guard where possible.
- Restrict lateral admin protocols.
- Monitor lateral logons and admin share access.

