ConceptsPass-the-Hash Detection

Pass-the-Hash Detection

Detecting pass-the-hash attacks by spotting the abnormal authentication patterns they create, such as logons using hashes in ways or from places that legitimate authentication would not, mapped to ATT&CK techniques.

Glossary definition

7 direct links5 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Identity Telemetry

The foundation Pass-the-Hash Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Identity TelemetryStart here

The activity data generated by identity systems, sign-ins, authentication results, privilege changes, access grants, and federation events, that feeds detection, hunting, and investigation of identity-based threats.

lessons

Relatedsorted by lesson coverage

Kerberoasting Detection

lessons

MITRE ATT&CK Framework

lessons

RDP Lateral Movement Detection

lessons

SMB Lateral Movement Detection

lessons

Pass-the-Hash

lessons

Lateral Movement Hunts

lesson

Related Lessons

5 lessons cover this concept

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Build Endpoint Behavior Analytics

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst