Patchfirst
T1550.002Lateral Movement

Pass the Hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the…

attack.mitre.org ↗
CVEs4
In 4
Reports0

Detections

6 Sigma rules tagged T1550.002

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Pass the Hash

4 CVEs, by priority. Each link shows its badge.
  1. CVE-2023-23397Microsoft Office Outlook Privilege Escalation Vulnerability
    Microsoft · OfficeKEVPublic exploitCritical · 9.8T1078Valid AccountsT1550.002Pass the Hash
    MITRE CTID mapping of the KEV entry · primary impact
    97.2%Top 0.11%
    79.8priority
  2. CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
    Ivanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    68.2priority
  3. CVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
    Ivanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    91.0%Top 0.19%
    68.2priority
  4. CVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
    Ivanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    89.8%Top 0.21%
    68.2priority
↑ ↓ chooseEnter openEsc close