Ravi Sir's Cyber Security Cards › Interview Cards
Pass-the-Hash – what do defenders do?
Pass-the-Hash – what do defenders do? Pass-the-Hash reuses an NTLM password hash to log in without knowing the plain password. An attacker who grabs a hash on one PC uses it to authenticate elsewhere. “Defence: LAPS, Credential Guard, fewer local admins, prefer Kerberos, and tiered admin.” It lets a
Read card text
What this card says
Short answer
Pass-the-Hash reuses an NTLM password hash to log in without knowing the plain password.
Example
An attacker who grabs a hash on one PC uses it to authenticate elsewhere.
Say it in the interview
“Defence: LAPS, Credential Guard, fewer local admins, prefer Kerberos, and tiered admin.”
Why it matters
It lets attackers move around without ever cracking the password.
Learn more in the lesson: 46.9 AD, Malware, Session, IoT and Mobile — Defensive Talking Points