Pass-the-Hash has been a documented Windows attack technique for over two decades, and it still works in 2026 because it exploits a design decision, not a bug. NTLM authentication doesn't require the plaintext password — it only requires proof that you know the password's hash. If an attacker already has that hash, they never need to crack it.
How PtH works
Once an attacker gains local administrator access on a single workstation, they can extract NTLM password hashes from LSASS memory or the SAM database. From there, they can authenticate to any other system on the network that accepts that same hash — impersonating the account without ever knowing its real password. This is exactly how a single compromised endpoint escalates into domain-wide compromise: the attacker hunts for a cached Domain Admin hash and pivots straight to it.
Detecting Pass-the-Hash
- Event ID 4624, Logon Type 3 (network) — from accounts that don't normally authenticate that way.
- Unusual LSASS access — process handles opened against lsass.exe by non-standard tools (a classic Mimikatz signature).
- Impossible travel logons — the same account authenticating to systems it has no operational reason to touch, in rapid succession.
Co-published with NexSecure Cybersecurity · Nathaniel T.O, SOC Analyst
Mitigating Pass-the-Hash
Microsoft's Credential Guard isolates LSASS secrets from the rest of the OS using virtualisation-based security, which blocks most hash-dumping tools outright. Beyond that, enforcing unique local administrator passwords per machine (via LAPS), restricting administrative accounts from logging into standard workstations, and tiering your Active Directory admin model all shrink the blast radius when — not if — one endpoint gets compromised.
Key takeaways
- PtH doesn't require cracking a password — only stealing its hash.
- One compromised workstation with a cached privileged hash can mean full domain compromise.
- Credential Guard + LAPS + admin tiering together close most of the practical attack surface.