Pass-the-hash

Authenticating with a captured NTLM hash instead of the password

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Lowlabpartially detected

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1550.002 · Invoke-WMIExec Pass the Hash · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1550.002 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1550.002 -TestGuids f8757545-b00a-4e4e-8cfb-8cfb961ee713 -TimeoutSeconds 120'

ATT&CK T1550.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1550.002 -Tool atomic -RunId run-2026-10-11-003 -Command 'Invoke-AtomicTest T1550.002 -TestGuids f8757545-b00a-4e4e-8cfb-8cfb961ee713 -TimeoutSeconds 120'

What our lab measured

partially detected windows · 2026-10-11

What it looked like in telemetry

Log source	What it means
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
Security · EID 4672	Special privileges assigned to new logon.

Plus 6 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100221, 100240 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~503 incidental alerts/hour — tune against this.

5 public Sigma rule(s) also target this technique.

Classification

24 values: 8 reviewed, 2 lab-measured, 8 imported, 6 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	Windows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Lateral Movement

Detection & telemetry

Detectability (measured in our lab)	Low
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestLogon Session CreationNetwork Connection CreationProcess Creation
Defense bypassed	System access controls

Detection & response

Mitigated by 16

M1018 attack-mitigation
M1026 attack-mitigation
M1051 attack-mitigation
M1052 attack-mitigation
D3-ABPI d3fend
D3-HBPI d3fend
D3-HR d3fend
D3-HS d3fend
D3-KBPI d3fend
D3-PLA d3fend
D3-PS d3fend
D3-PSA d3fend
D3-PSMD d3fend
D3-PT d3fend
D3-SCF d3fend
D3-WSAM d3fend

Detected by 7

DET0409 attack-detection-strategy
192a0330-c20b-4356-90b6-7b7049ae0b87 sigma
24549159-ac1b-479c-8175-d42aea947cae sigma
8eef149c-bd26-49f2-9e5a-9b00e3af499b sigma
98c3bcf1-56f2-49dc-9d8d-c66cf190238b sigma
e9d4ab66-a532-4ef7-a502-66a9e4a34f5d sigma
f8d98d6c-7a07-4d74-b064-dd4a3c244528 sigma

Tested by 3

eb05b028-16c8-4ad8-adea-6f5b219da9a9 atomic
ec23cef9-27d9-46e4-a68d-6f75f7b86908 atomic
f8757545-b00a-4e4e-8cfb-8cfb961ee713 atomic

Attack relationships

Parent: Primary Refresh Token (PRT) theft

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-11-003`	partially-detected	atomic	windows	2026-10-11

run-2026-10-11-003 — atomic_tests=3 public_sigma_rules=5 caldera=not-indexed; expected=0 incidental=13 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1550/
attack: T1550.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 319 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 22 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-11) — Lab detonation run-2026-10-11-003 (partially-detected) for T1550.002: no alert matched the expected technique