What is a Pass-the-Hash attack, and how do you catch it?
What is a Pass-the-Hash attack?
When you log into a Windows server, your password is never sent as plain text — it's converted into an NTLM hash and that hash is what actually authenticates you. Pass-the-Hash abuses this directly: an attacker who has already compromised one machine can steal that hash from memory and use it to log into other servers, without ever knowing the real password.
It's one of the most common ways a single compromised laptop turns into a full network breach — the attacker doesn't need to crack anything, they just reuse what's already there.
Why it's hard to catch
The login itself looks completely legitimate — it's a real, valid authentication using a real account. Most basic monitoring only flags failed logons, not successful ones using an unusual method. The signature that gives it away is specific: a network logon (not an interactive one) authenticated via NTLM instead of Kerberos, landing on an account that happens to be a local administrator.
How the SolveBeat Agent catches it
- Reads the server's own Windows Security event log (Event ID 4624) — no extra logging needs enabling, it's on by default.
- Flags any network logon (Logon Type 3) using NTLM against an account in the local Administrators group.
- Tags the finding with its real MITRE ATT&CK technique (T1550.002) and a response playbook — reset the account, isolate the host, check what else that IP touched.
It's one of eight behaviour-based detections the Agent runs locally on your own server — read-only, source published, nothing sent back except the finding itself.