T1550.002Lateral Movement
Pass the Hash
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports0
Detections
6 Sigma rules tagged T1550.002Pass the HashT1550.0026 general rules
- Hacktool Rulerhightest
- Successful Overpass the Hash Attempthightest
- Pass the Hash Activity 2mediumstable
- NTLMv1 Logon Between Client and Servermediumtest
- Potential Pass the Hash Activitymediumtest
- NTLM Logonlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Pass the Hash
4 CVEs, by priority. Each link shows its badge.- CVE-2023-23397Microsoft Office Outlook Privilege Escalation VulnerabilityMITRE CTID mapping of the KEV entry · primary impact97.2%Top 0.11%79.8priority
- CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%68.2priority
- CVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · primary impact91.0%Top 0.19%68.2priority
- CVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · primary impact89.8%Top 0.21%68.2priority