Technique
technique:pass_the_hash
Also: passing the hash
Authenticating with a password hash instead of the corresponding plaintext password.
Authenticating with a password hash instead of the corresponding plaintext password.
“First thing I try to do is pass the hash”
Credential-abuse technique mentioned as a way to authenticate remotely using credential material.
“SMB, passing the hash or even the plain text password”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Project Raven | Explicit | 47 |
Tinker Secor USES pass the hash
Tinker attempted to authenticate to other computers using the recovered local administrator hash.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“First thing I try to do is pass the hash which just uses the actual hash as a password.”
Project Raven USES pass the hash
The team used pass-the-hash or plaintext credentials for remote access during lateral movement.
Explicit Confidence 99% · David EP 47 Details
“passing the hash or even the plain text password”