Pass-the-Hash: how the NTLM attack works without the password

An attacker compromises a workstation on the corporate network. They don't have the domain administrator's password — but that doesn't matter. With the NTLM hash extracted from memory, they authenticate to dozens of servers as if they were the administrator themselves. This is Pass-the-Hash: an attack that has existed since 1997, documented by researcher Paul Ashton, and that still fuels the early stages of ransomware attacks and APT campaigns today.

What NTLM is and why it stores hashes

Windows never stores passwords in plain text. When you set a password, the system calculates an NT hash (MD4 of the password in Unicode) and stores that value — in the local machine's SAM database, or in Active Directory in a domain environment.

For network authentication (SMB, RDP, RPC), the NTLM protocol works like this:

1. The server sends a challenge (a random number).
2. The client encrypts that challenge using the password's NT hash.
3. The server validates the response by comparing it against its own copy of the hash.

Notice: at no point does the plain-text password travel over the network or get used directly. The NT hash is the functional credential for NTLM authentication.

How Pass-the-Hash works in practice

If an attacker manages to extract a user's NT hash, they can use it directly in step 2 above — without needing to reverse the hash back into the original password. The attack flow is:

1. Compromise a machine with enough privilege to read the memory of the lsass.exe process.
2. Extract NTLM hashes with tools like Mimikatz (sekurlsa::logonpasswords) or Impacket variants.
3. Inject the hash into an authentication session and connect to another host on the network that accepts NTLM.

The result: authenticated access as the victim on any system where they had permissions, without typing a single letter of the real password.

What is lateral movement in this context?

Lateral movement is when an attacker uses credentials stolen from one machine to spread to others on the same network. In Pass-the-Hash, a single privileged account's hash can open the door to hundreds of servers if the account policy reuses the same local administrator password across multiple machines — a situation still common in networks without centralized management.

MITRE ATT&CK catalogs Pass-the-Hash as T1550.002 and documents active use by more than 40 threat groups in recent operations, including campaigns that precede ransomware deployment.

Why can't the hash simply be invalidated once it's stolen?

The NT hash only changes when the password changes. As long as the account exists with the same password, the hash stays valid. Networks with service accounts whose passwords never change — or local administrators sharing the same password across 500 machines — create huge surfaces that let this kind of attack persist silently.

That explains why LLMNR poisoning (a technique for capturing NTLM hashes via network name spoofing, explained in LLMNR Poisoning — how Windows hands out NTLMv2 hashes on the network) is usually the step that precedes Pass-the-Hash: the attacker first captures the hash, then reuses it.

How to block Pass-the-Hash

Disable NTLMv1 (and evaluate NTLMv2)

NTLMv1 is easier to exploit and has no reason to exist on modern networks. Configure it via GPO:

Computer Configuration → Windows Settings → Security Settings
→ Local Policies → Security Options
→ Network security: LAN Manager authentication level
→ Send NTLMv2 response only; refuse LM & NTLM

Microsoft announced automatic enforcement of NTLMv1 blocking starting in October 2026 — but don't expect that to happen passively: roll out the GPO now.

Enable Credential Guard

Windows Defender Credential Guard isolates the lsass.exe process inside a virtualized environment (VSM — Virtual Secure Mode). With it enabled, tools like Mimikatz can't read hashes from the main operating system's memory. Available from Windows 10 Enterprise / Server 2016 onward; enabled by default from Windows 11 22H2 on compatible hardware.

Protected Users security group

Adding privileged accounts to the Protected Users group in Active Directory forces those accounts to use only Kerberos — NTLM authentication becomes forbidden for them. This doesn't eliminate the risk of Pass-the-Ticket (the Kerberos variant), but it completely removes the NTLM vector for the most sensitive accounts.

LAPS — unique passwords per machine

The Local Administrator Password Solution (LAPS) generates random, unique passwords for the local administrator account on every Windows machine, stored securely in AD. With LAPS, stealing machine A's local admin hash doesn't grant access to machine B — lateral movement via local accounts is eliminated. LAPS 2.0 (Windows LAPS, native to Windows Server 2022 and Windows 11 23H2) replaced the legacy version and requires no additional extension.

Administrative tiering (three-tier model)

Microsoft's Tier 0/1/2 model isolates credentials by level: domain administrators never log into regular workstations; workstation administrators never touch servers. That way, even if a Tier 1 hash is stolen on a workstation, it's useless for reaching domain controllers.

Monitor authentication events

Windows events that flag Pass-the-Hash:

• 4624 (successful logon) with Logon Type 3 (network) and Logon Process = NtLmSsp for accounts that normally use Kerberos.
• 4625 (failed logon) in a series with code 0xC000006D — invalid hash attempts.
• Privileged account logon at an unusual time or on a machine it has never accessed before.

These correlations get easier with a SIEM or tools like Microsoft's ATA (Advanced Threat Analytics) / Defender for Identity, which already have PtH detection built in.

Relationship to other Windows credential attacks

Pass-the-Hash rarely appears in isolation. The most common chain in ransomware attacks starts with phishing or exploitation of an exposed RDP — worth reviewing how to protect RDP against brute force and ransomware as a complementary measure. After obtaining a hash, an attacker can escalate to Kerberos techniques like Overpass-the-Hash (converting an NTLM hash into a Kerberos ticket) to attack services that require Kerberos. Stealing an authenticated session — session hijacking, explained here — shares the same logic of reusing proof of identity without needing the password.

Conclusion

Pass-the-Hash has lasted nearly three decades because it exploits a structural feature of NTLM, not a bug that will get fixed in a patch. Real defense is layered: disable NTLMv1, enable Credential Guard, use LAPS, keep sensitive accounts out of NTLM's reach with Protected Users, and monitor for anomalous authentications. To go deeper on how attackers capture hashes before reusing them, read the post on LLMNR Poisoning — the two attacks form a classic pair in internal network pentest assessments.