Pass-the-Hash Prevention: Stop Credential Theft Without NTLMv2

Who Needs This Checklist and How to Use It

This checklist targets system administrators and security engineers managing Windows-based environments. Pass-the-hash attacks exploit the NTLM authentication protocol to reuse credential hashes without knowing the plaintext password. You use this list to harden authentication paths and reduce the surface area for lateral movement. Each item addresses a specific gap in your defense-in-depth strategy.

Eliminate NTLM Authentication Paths

• Enforce Kerberos for all internal service communication: NTLM relies on hash transmission, while Kerberos uses tickets that cannot be reused without the key distribution center.
• Disable NTLM on domain controllers via Group Policy: Prevents the infrastructure itself from accepting legacy authentication methods that bypass modern security controls.
• Configure NTLM audit policies to log all attempts: Visibility into failed or successful NTLM use identifies legacy dependencies and active abuse.
• Restrict NTLM access to specific, isolated network segments: Limits exposure if a legacy application cannot be immediately migrated to modern protocols.

Secure Credential Storage and Memory

• Enable Windows Credential Guard on all endpoints: Uses virtualization-based security to isolate secrets from the operating system kernel, preventing extraction.
• Configure LSA protection to prevent third-party access: Blocks untrusted processes from reading the Local Security Authority, where hashes are often stored.
• Rotate local administrator passwords frequently and uniquely: Ensures that a stolen hash from one machine does not grant access to others in the same group.
• Disable cached credentials on mobile or remote devices: Prevents offline access to the machine if the device is lost or stolen.

Monitor for Hash Extraction and Replay

• Detect Event ID 4624 with Logon Type 3: Identifies network logons that often indicate pass-the-hash or pass-the-ticket activity.
• Alert on multiple failed NTLM authentications from a single source: Suggests an attacker is trying to reuse hashes across different systems.
• Monitor for unusual service principal name (SPN) registration: Indicates potential Kerberoasting, a related technique that targets service account keys.
• Track outbound traffic to known command-and-control domains: Pass-the-hash is often a precursor to data exfiltration or further compromise.

Imagine an attacker compromises a single workstation. Without these controls, they extract the NTLM hash and pivot to the file server. With these controls, the hash is useless, and the attack stops at the endpoint. This scenario highlights the importance of breaking the authentication chain early.

Harden Network Segmentation and Access

• Implement micro-segmentation between critical asset groups: Restricts lateral movement even if an attacker successfully authenticates to one segment.
• Apply least-privilege access to file shares and databases: Ensures that a valid hash does not grant administrative rights to sensitive resources.
• Disable unused network protocols such as SMBv1: Reduces the attack surface for older exploitation techniques that often accompany hash theft.
• Validate inbound connections with mutual TLS where possible: Adds an extra layer of authentication that does not rely on username and password hashes.

See also: How the MITRE ATT&CK Navigator Maps Tactics to Detection · How Small Businesses Use ISACs for Threat Intelligence

Validate Defenses with Controlled Testing

• Conduct red team exercises focusing on lateral movement: Tests whether your detection rules trigger during simulated pass-the-hash attacks.
• Review Sysmon logs for process creation anomalies: Identifies tools like Mimikatz or custom scripts that attempt to extract credentials from memory.
• Verify that endpoint detection and response solutions are updated: Ensures signatures and behavioral models recognize current credential theft techniques.
• Assess the effectiveness of your network segmentation: Confirms that compromised credentials cannot traverse security boundaries as intended.

Integrate with Broader Security Frameworks

You should align these controls with your existing threat intelligence practices. Refer to your guides on MITRE ATT&CK Navigator to map these techniques to specific adversary behaviors. Use Snort and Suricata rules to detect network-level indicators of hash reuse.

Consider canary tokens in sensitive directories to alert you when an attacker accesses resources they should not. For deeper visibility, review your Sysmon configuration to ensure it captures the necessary process and network events. Understanding scheduled task abuse helps you defend against persistence mechanisms that often follow credential theft.

Key takeaways

• NTLM is the primary vector for hash reuse, making its removal the single most effective control.
• Credential Guard prevents the extraction of secrets from memory, blocking the theft required for this attack.
• Network segmentation limits the blast radius when an attacker successfully reuses a stolen hash.

Frequently asked questions

How do I know if pass-the-hash is happening in my network?

Look for Event ID 4624 with Logon Type 3 from unexpected sources, especially if the source IP is not a known service account.

Can Credential Guard be bypassed?

While highly effective, it can be bypassed if an attacker has local administrator privileges and can disable virtualization-based security features.

Does disabling NTLM affect remote desktop connections?

Remote Desktop Protocol typically uses Kerberos by default, but ensure your Group Policy does not fall back to NTLM for compatibility.

What is the difference between pass-the-hash and pass-the-ticket?

Pass-the-hash uses NTLM hashes to authenticate, while pass-the-ticket reuses Kerberos tickets, requiring different detection and mitigation strategies.

How this guide was produced: written by the TechSec Feed editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.