CAPEC-644: Use of Captured Hashes (Pass The Hash)
Description
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- The system/application is connected to the Windows domain.
- The system/application leverages the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
- The adversary possesses known Windows credential hash value pairs that exist on the target domain.
Skills required
- LowOnce an adversary obtains a known Windows credential hash value pair, leveraging it is trivial.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- ConfidentialityAuthorization
Read Data
- Integrity
Modify Data
Mitigations
- Prevent the use of Lan Man and NT Lan Man authentication on severs and apply patch KB2871997 to Windows 7 and higher systems.
- Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
- Monitor system and domain logs for abnormal credential access.
- Create a strong password policy and ensure that your system enforces this policy.
- Leverage system penetration testing and other defense in depth methods to determine vulnerable systems within a domain.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.