Pass-the-Hash

Pass-the-Hash: Authentication attack that uses a stolen hash instead of the plaintext password. The term is relevant to the assessment and design of modern security architectures and should be applied within the specific technical and organizational context.

How it works and where it fits

Technically, Pass-the-Hash describes an attack path or a concrete method rather than a single suspicious event. A sound assessment separates prerequisites, entry point, objective, intermediate steps, and expected effect. The same technique can produce very different outcomes depending on system architecture, available privileges, exposure, and existing safeguards.

Practical security relevance

In practice, both preventive measures and observable traces matter. Secure configuration, restricted privileges, robust input and identity checks, and telemetry at affected trust boundaries all contribute. A single indicator rarely proves an attack; reliable detection, containment, and remediation require the combined context of timing, source, target, and observed impact.

Related concepts

• Pass-the-TicketPass-the-TicketMisuse of stolen Kerberos tickets to assume an identity.: Misuse of stolen Kerberos tickets to assume an identity.
• Account TakeoverAccount TakeoverUnauthorized takeover of a user account using stolen credentials.: Unauthorized takeover of a user account using stolen credentials.
• Lateral MovementLateral MovementAn attacker's movement from a compromised system to other systems.: An attacker’s movement from a compromised system to other systems.
• Credential StuffingCredential StuffingAutomated login attempts using stolen username-password combinations obtained from other services.: Automated login attempts using stolen username-password combinations obtained from other services.