Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Treat a suspected Pass-the-Hash (PtH) alert as an investigation trigger, not proof by itself. Preserve the alert and supporting telemetry, build a timeline of the account, source host, destination and service, contain compromised identities and systems without destroying evidence, then rotate exposed credentials from a known-good administrative environment. Scope every account and device the identity touched before recovery, and validate that identity infrastructure was not compromised.
What Pass-the-Hash means
MITRE ATT&CK classifies Pass the Hash as sub-technique T1550.002, Use Alternate Authentication Material, under Lateral Movement. An adversary who has obtained a valid password hash can authenticate as that user without knowing the cleartext password. The attack reuses authentication material already obtained; it is not password guessing.
“Pass the hash (PtH) is a method of authenticating as a user without having access to the user’s cleartext password.” — MITRE ATT&CK, T1550.002 (current page version 2.0, modified May 12, 2026)
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Investigations can also encounter “overpass the hash.” In that variation, hash material is used to obtain a Kerberos ticket, so evidence may involve both NTLM and Kerberos rather than NTLM alone. A single anomalous NTLM event therefore cannot establish PtH; legitimate legacy authentication, other credential misuse and configuration problems can look similar.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
First response: preserve, contain and coordinate
Do not begin by rebooting or wiping the computer that generated the alert. Follow your incident process, record the time zone used by every system, and preserve the alert, event logs, endpoint telemetry and identity records before retention limits remove them.
- Open incident coordination. Assign an incident lead and involve identity, endpoint, server and application owners. Record who authorized containment and every change made.
- Preserve the initial signal. Export the detection details, affected entities, timestamps, source and destination names, account identifiers and any linked investigation view. Capture relevant Windows Security, Sysmon, endpoint and directory records in their original time context.
- Define an initial scope. List potentially affected accounts, endpoints, servers, applications and administrative tiers. Find the earliest suspicious activity and search for other systems to which the account authenticated.
- Contain likely compromised identities. Disable accounts believed compromised, prioritizing privileged accounts, or otherwise block their use under your organization’s emergency procedure. Use known-good administrative access for this work. Coordinate with service and application owners so that containment does not create an uncontrolled outage.
- Isolate affected systems. Place likely compromised hosts in a network-isolation state that preserves their disk and memory state where your tooling supports it. Microsoft incident-response guidance says not to turn isolated compromised systems off; if operational circumstances require a different action, document the reason and obtain incident-lead approval.
- Protect the control plane. Check whether domain controllers, identity-management systems, administrative workstations or other control-plane assets were involved before declaring that a single workstation is the boundary of the incident.
Which evidence to collect and correlate
MITRE’s DET0409 detection strategy recommends correlating anomalous NTLM network logons with account context, source and destination systems, session creation, process activity and network activity. The following sources are useful when the relevant audit policy, Sysmon configuration and retention period made them available at the time.
| Telemetry | What to examine | How it helps |
|---|---|---|
| Windows Security event 4624 | Successful logon time, account, source workstation or address, destination host, authentication package and logon type | Shows where and when a session was created; unusual NTLM network-logon patterns can anchor the timeline |
| Windows Security event 4648 | Explicit-credential use, account supplied, initiating process and target system | Connects credential use to a process and can reveal activity adjacent to a suspicious session |
| Kerberos event 4768 | Ticket-request time, requesting account and client information | Helps identify Kerberos activity, including possible overpass-the-hash paths |
| Sysmon event 1 | Process creation, parent process, command line, user and integrity context | Links a logon to programs that may have initiated remote access or credential use |
| Sysmon event 3 | Network connection time, source and destination, process and protocol details | Correlates the session with outbound connections and possible lateral movement |
| Sysmon event 22 | DNS query time, process and queried name | Provides surrounding name-resolution activity for destinations contacted by the host |
| Endpoint and identity telemetry | Alerts, device timeline, account changes, group membership, sessions and authentication history | Adds context that individual Windows events may not contain and helps identify persistence or privilege changes |
Microsoft Defender for Identity documents suspicious SMB NTLM authentication and suspected Pass-the-Hash-related alert scenarios. Review each alert’s entities and context, then corroborate it against host and domain telemetry. A product alert is an investigative signal, not independent confirmation.
A practical investigation workflow
1. Anchor the suspected authentication
Start with the alert timestamp, then normalize all records to a single time zone while retaining the original timestamps. Identify the source host, destination host, account, authentication protocol, service and logon type. Note whether the account normally uses that source, target, time window and service. A privileged account authenticating from a user workstation, or an account appearing on multiple servers in a short interval, deserves immediate scrutiny, but treat those observations as leads rather than proof.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Build a minute-by-minute timeline
Place successful and failed logons, explicit-credential events, ticket requests, process creation, service creation, remote-execution indicators, network connections and administrative changes on one timeline. Search a window before and after the alert rather than looking only at the triggering event. Look for a sequence in which a session is created, a process starts, a connection reaches another host and a privileged action follows.
3. Test the NTLM hypothesis
Compare the authentication package and source-destination pair with normal behavior. DET0409 highlights anomalous NTLM network logons, particularly when expected accompanying domain-logon events are absent. Check whether the event is explained by a known legacy application, a scheduled job, a service account or an approved administrative workflow. NTLM by itself is not evidence that a hash was used.
4. Correlate process and network activity
Use process-creation records to identify the program and parent process associated with the session. Match its start time with Sysmon network connections and DNS queries, then inspect service creation, scheduled-task changes, remote-management activity and other remote-execution indicators in the same interval. Preserve the records even when the process appears legitimate; a trusted binary can still be launched under a stolen identity.
5. Trace the account across the environment
Search every available domain controller, server, workstation, VPN or remote-access system and business application for the account during the incident window. Record each source, destination, service, success or failure and privilege level. Repeat the search for related accounts, local administrator identities and service accounts found on the affected systems. This establishes whether the activity was limited to one host or represents lateral movement.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Look for credential access and persistence
Inspect the suspected source host for preceding credential-access activity and for changes that could let an intruder return: new local or domain accounts, group-membership changes, scheduled tasks, services, startup mechanisms, unauthorized remote-access settings and altered security controls. Examine identity infrastructure for the same changes. An endpoint compromise can expose credentials with broader reach, so do not close the investigation at the first machine.
7. Classify confidence and document alternatives
Write down the evidence that supports PtH, the evidence that argues for legitimate or different credential use, and the telemetry that was unavailable because of audit or retention settings. Separate “alerted,” “suspected,” and “confirmed” in incident records. This prevents an anomalous NTLM event from becoming an unsupported conclusion and makes later remediation decisions defensible.
How to scope the incident
Microsoft incident-response guidance frames scope around compromised accounts, affected devices and affected applications. Build an inventory with at least these dimensions:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Accounts: the suspected user, privileged identities, local administrators, service accounts and any accounts sharing credentials or appearing in the same timeline.
- Devices: the source workstation, every destination, servers that accepted the account, administrative workstations and identity infrastructure.
- Applications and services: file shares, remote-management services, scheduled jobs and business applications that used the account.
- Administrative tiers: whether the identity could reach server, virtualization, backup, directory or other control-plane functions.
- Time boundary: the earliest credible credential-access event through the latest suspicious authentication, including failed attempts that may show the adversary’s reach.
Use the inventory to decide which systems require forensic preservation, network isolation, credential rotation or rebuild. Do not assume that a clean-looking destination proves the source was clean; the attacker may have used it only to authenticate.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Containment without destroying evidence
Isolate hosts, preserve state
Network-isolate affected endpoints and servers using the least disruptive control that prevents further authentication and lateral movement. Preserve volatile and persistent evidence according to your organization’s procedures. Microsoft guidance specifically advises not powering off isolated compromised systems. If a safety, availability or legal requirement overrides that advice, record the decision, the person authorizing it and what evidence was collected first.
Disable or restrict identities
Disable likely compromised accounts, beginning with privileged identities, from a known-good administrative system. Consider dependencies such as scheduled jobs, services and emergency access accounts before taking an identity offline. Block active sessions and tokens where your identity platform supports that action, and document any exceptions that leave an account temporarily usable.
Protect recovery administration
Perform containment and recovery from a trusted administrative workstation or other known-good environment. Do not use an affected host to change passwords or administer the directory: replacement credentials entered there could be captured again. Keep emergency administrative accounts separate from the suspected identity and monitor their use.
Credential remediation and rotation
Rotate credentials according to the exposure path and confirmed scope. Prioritize privileged credentials, then accounts reused across hosts. Include local administrator passwords, service accounts and other secrets when the investigation indicates that they were present, exposed or reused; map dependencies first so rotation does not silently break critical services.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A password reset is one action in a broader response. It does not by itself prove that an attacker has been removed, erase persistence or clean an affected device. Complete host investigation, identity scoping and recovery validation before closing the incident.
MITRE recommends limiting credential overlap between systems and avoiding the practice of making the same domain user a local administrator on multiple systems. Separate administrative identities by tier and purpose, remove unnecessary local-admin rights and document exceptions for legacy applications.
Use Windows LAPS for local administrator accounts
Windows Local Administrator Password Solution (Windows LAPS) automatically manages rotation of local administrator passwords and is documented by Microsoft as a protection against Pass-the-Hash and lateral-traversal attacks. It reduces the blast radius of shared local administrator passwords. It does not remediate a compromised domain account and does not establish that an affected device is clean, so deploy it alongside—not instead of—incident response and credential rotation.
Recommended Free Tools
Hardening controls after containment
Credential Guard, Windows LAPS, Remote Credential Guard and passwordless authentication address different paths. Compare them by the secret or exposure path they protect, supported device and join state, application compatibility, rollout requirements and recovery implications.
| Control | Primary protection | Scope and requirements | Important limitation |
|---|---|---|---|
| Credential Guard | Uses virtualization-based security to isolate protected NTLM and Kerberos secrets | Requires supported Windows client or server editions and compatibility review; verify current configuration before deployment | Does not protect the Active Directory database on domain controllers; incompatible applications may require exceptions or redesign |
| Windows LAPS | Rotates local administrator passwords to reduce shared-secret reuse | Applies to managed Windows devices and requires an operational management and recovery process | Does not fix a compromised domain identity or prove host cleanliness |
| Remote Credential Guard | Reduces exposure of user credentials to a remote desktop target | For supported Remote Desktop scenarios; requires Kerberos authentication and a domain-joined target | It is not a general-purpose Pass-the-Hash cleanup control and does not cover every remote-management protocol |
| FIDO2 security keys | Add a passwordless authentication method that resists password reuse | Deploy alongside an identity provider, enrollment, recovery and account-lifecycle process | They do not replace host isolation, evidence collection or credential rotation during an active incident |
| Windows Hello for Business or smart cards | Provide additional passwordless or certificate-backed sign-in options | Require supported identity, device and certificate-management designs | Rollout, legacy-application compatibility and recovery paths must be validated before broad enforcement |
Microsoft recommends adding passwordless methods such as Windows Hello for Business, FIDO2 security keys or smart cards alongside credential protections. Validate every authentication change against legacy applications and operational requirements rather than applying broad restrictions during an uncontrolled incident.
Quick Recap
Recovery and validation
- Eradicate persistence. Remove unauthorized accounts, privilege assignments, scheduled tasks, services and remote-access changes. Rebuild systems when your incident standard requires higher assurance than cleaning can provide.
- Restore from a trusted baseline. Reintroduce hosts only after required patches, security controls, configuration changes and credential rotations are complete.
- Recheck identity infrastructure. Verify domain controllers and other control-plane systems were not altered or used as staging points. Confirm that privileged accounts, group memberships and administrative workstations match approved state.
- Monitor for recurrence. Continue searching for anomalous NTLM network logons, unexpected Kerberos ticket requests, new source-destination pairs, privilege changes and authentication from rebuilt or isolated systems.
- Close with evidence. Record the final affected-account and affected-device list, the earliest and latest known activity, controls applied, residual uncertainty caused by missing telemetry and the owner for follow-up work.
Common investigation mistakes
- Calling every NTLM anomaly PtH: NTLM is an authentication protocol, not proof that a stolen hash was replayed. Correlate context, process and network evidence.
- Resetting passwords on a suspect host: Use a known-good administrative system so replacement secrets are not exposed again.
- Powering off the isolated machine automatically: Preserve state when possible; document any emergency exception.
- Scoping only the triggering workstation: Search every account destination, related local administrator, service account, application and administrative tier.
- Treating an alert as confirmation: Product detections and analytic strategies identify suspicious patterns. Assign confirmation only after corroboration.
- Deploying a control as a universal fix: Credential Guard, LAPS, Remote Credential Guard and passwordless methods protect different paths and have different compatibility limits.
- Ignoring telemetry gaps: State which audit policies, Sysmon rules or retention periods were unavailable; absence of an event is not evidence that the action did not occur.
Investigation checklist
- Preserve alerts, logs, endpoint telemetry and identity records with timestamps and time zones.
- Identify source, destination, account, service, authentication package and logon type.
- Correlate Security 4624 and 4648, Kerberos 4768, and Sysmon 1, 3 and 22 when available.
- Trace process creation, network connections, service or task changes and privilege activity.
- Inventory affected accounts, devices, applications and administrative tiers.
- Isolate systems without powering them off when possible.
- Disable likely compromised identities and rotate exposed credentials from known-good administration.
- Remove persistence, verify identity infrastructure and monitor for recurrence.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
