ATT&CK coverage › Technique

Use Alternate Authentication Material: Pass the Hash T1550.002

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Events covered

7 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Security-Auditing4624An account was successfully logged on.
Security-Auditing4625An account failed to log on.
Security-Auditing4688A new process has been created.
Security-Auditing4776The domain controller attempted to validate the credentials for an account.
LsaSrv6038Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server.
LsaSrv6039Microsoft Windows Server has detected that NTLM authentication is being used between clients and this server.
NTLM8002NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blocked.

Authoring guide

Patterns shared across the 7 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (13 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
LogonProcessName3eq 3seclogo, NtLmSsp
LogonType3eq 39, NewCredentials, 3
EventType1eq 1logged-in
event.category1eq 1authentication
user.id1starts_with 1S-1-12-1-, S-1-5-21-
event.outcome1eq 1success
Workstation1eq 1RULER
WorkstationName1eq 1RULER
Provider_Name1eq 1LsaSrv
SubjectUserSid1eq 1S-1-0-0
user1eq 1ANONYMOUS LOGON
KeyLength1eq 10
AuthenticationPackageName1eq 1Negotiate

Top indicator values (17 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
LogonProcessNameeqseclogo33
LogonTypeeq925
EventTypeeqlogged-in17
event.categoryeqauthentication15
event.outcomeeqsuccess18
user.idstarts_withS-1-5-21-1
LogonTypeeqNewCredentials1
user.idstarts_withS-1-12-1-1
WorkstationNameeqRULER1
WorkstationeqRULER1
Provider_NameeqLsaSrv1
KeyLengtheq01
SubjectUserSideqS-1-0-012
usereqANONYMOUS LOGON13
LogonProcessNameeqNtLmSsp1
LogonTypeeq3112
AuthenticationPackageNameeqNegotiate13

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 5 rules

Elastic 1 rule

Kusto Query Language 1 rule