Cross-source coverage
T1075 / ATT&CK
Pass the Hash
ATT&CK has retired this technique. Rules still tag it; the current id is T1550.002 Use Alternate Authentication Material: Pass the Hash.
3 rules across 1 source.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.
- Tactics
- Lateral Movement
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| hacktool_use | Undefined | YARA-L |
| rubeus_hack_tool_sysmon | Undefined | YARA-L |
| rubeus_hack_tool_windows_security | Undefined | YARA-L |