T1550.002 — Pass the Hash

Tactic: Lateral Movement · Platforms: Windows

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard…

Sub-technique of Use Alternate Authentication Material (T1550).

Sigma detection rules (1)

T1550.002 Use Alternate Authentication Material: Pass the Hash

title: "T1550.002 Use Alternate Authentication Material: Pass the Hash"
id: f130e4d3-a96a-45a3-a934-77cb9b5eed90
description: 'Detection Strategy for T1550.002 - Pass the Hash, retargeted to NTLM network logon telemetry (EventID 4624, LogonType 3, AuthenticationPackageName NTLM). Broad proxy requiring correlation. (Data Component: Logon Session Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, SourceAccountAnomalyThreshold, LogonTypeFilter.'
references:
  - https://attack.mitre.org/techniques/T1550/002
author: Shahrukh Khan
date: 2026-01-05
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4624'
    LogonType: '3'
    AuthenticationPackageName: 'NTLM'
  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_machine_account:
    TargetUserName|endswith: '
    
  


  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate NTLM authentication (non-domain resources, legacy apps, workgroup access).

level: medium

Related sub-techniques

Explore