What is pass-the-hash?¶
The practical answer¶
Pass-the-hash is a technique in which a password-derived hash is used to authenticate without knowing or entering the original password.
The key evidential caution¶
The dangerous assumption is that successful access always means the offender knew the password.
It may not.
If a system accepts the hash as part of authentication, possession of that hash may be enough to obtain access.
The hash may have been extracted from memory, credential stores or another compromised system.
What investigators should establish¶
Investigators should establish:
Key points¶
- which account the hash represented
- where it may have been obtained
- which system accepted it
- what authentication protocol was used
- what source device initiated the access
- what activity followed
Relevant evidence¶
Relevant evidence may include credential-access artefacts, authentication logs, remote-service records, endpoint telemetry, process activity and later administrative actions.
Evidential limits¶
Do not assume that every authentication using the account involved pass-the-hash.
Provider or platform-specific interpretation may require specialist support.
Likewise, the account holder may never have disclosed or typed the password during the incident.
A successful pass-the-hash event can show account misuse and lateral movement.
It does not identify who extracted or used the hash.
Hash-based access may leave authentication events that resemble ordinary account use. Interpretation should therefore be supported by credential-access evidence, protocol details and the surrounding source-system activity rather than the login result alone.
Specialist interpretation may be required where the available logs do not expose the authentication detail directly.
Record that limitation explicitly.
Operational takeaway¶
Consider hash-based authentication where access succeeds without evidence of password entry, and preserve the source, account, protocol and target records.