Overpass the Hash is a post-exploitation technique where an attacker uses a stolen NTLM hash to authenticate and obtain Kerberos tickets. It turns hash theft into a usable login session, allowing access as the compromised user without needing the plaintext password. The technique is especially dangerous in Active Directory environments that still rely on NTLM.
Expanded Definition
Overpass the Hash is a credential-theft follow-on technique in which a captured NTLM hash is used to request Kerberos service tickets or a ticket-granting ticket, converting a static secret into an active authenticated session. In Windows environments, it matters because NTLM hashes are often easier to reuse than plaintext passwords are to recover. The technique sits at the intersection of identity compromise and lateral movement, and it is especially relevant where legacy Windows authentication, weak workstation hygiene, or over-privileged service accounts still exist. Industry usage is consistent on the core action, but implementation details vary across vendors and incident response playbooks, particularly around whether the attacker is using injected credentials, pass-the-hash tooling, or direct Kerberos ticket acquisition. For governance, the key distinction is that the hash is not merely stolen data; it becomes an authentication bearer artifact once the attacker can leverage it. The most common misapplication is treating overpass the hash as a password problem only, which occurs when defenders fail to recognize that compromised NTLM material can remain operational even after the user changes their password.
For baseline identity and access context, see the NIST Cybersecurity Framework 2.0, which frames credential misuse under protection and detection outcomes.
Examples and Use Cases
Implementing detection and containment for this technique often introduces monitoring overhead and false positives, requiring organisations to weigh faster compromise detection against the cost of more detailed authentication telemetry.
- An attacker steals a hash from a compromised endpoint and uses it to obtain a Kerberos ticket, then accesses file shares as the victim without knowing the password.
- A compromised service account with NTLM enabled is reused to pivot from one server to another, especially where local administrator reuse or weak tiering is present.
- A red team validates whether Kerberos logs, ticket anomalies, and workstation protections can reveal hash-based authentication abuse before lateral movement succeeds.
- Security teams use the Ultimate Guide to NHIs to compare the risks of stolen long-lived credentials with broader NHI governance patterns.
- In hybrid environments, operators phase out NTLM where possible and use stronger identity controls to reduce the usefulness of captured hash material.
Technical response guidance also aligns with the NIST Cybersecurity Framework 2.0, especially where authentication monitoring and access control improvements are being prioritised.
Why It Matters in NHI Security
Overpass the Hash is a reminder that identity compromise is often about privilege conversion, not just credential exposure. Once an attacker can turn a hash into an authenticated session, perimeter controls, password complexity rules, and even routine password resets may not stop the intrusion. That is why NHI governance must treat all reusable secrets as high-value authentication material, including service account hashes, cached credentials, and automation identities that still rely on Windows authentication paths. NHIMG research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a strong signal that long-lived credential reuse remains a material enterprise weakness. The same operational blind spots that enable NHI compromise also help attackers persist after initial access, especially when privilege boundaries are weak and rotation is inconsistent. Additional identity hygiene guidance appears in the Ultimate Guide to NHIs, which links lifecycle control, visibility, and rotation to reduced compromise impact. Organisations typically encounter the consequence only after lateral movement or an internal breach investigation, at which point overpass the hash becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers misuse of reusable credentials and secret exposure that enable hash-based authentication abuse. |
| NIST CSF 2.0 | PR.AC-4 | Access control and credential use monitoring are directly implicated by reused NTLM hashes. |
| NIST Zero Trust (SP 800-207) | SC-2 | Zero Trust assumes compromised credentials must not be implicitly trusted across sessions. |
| NIST SP 800-63 | AAL2 | Authenticator assurance guidance highlights weaknesses in legacy reusable secret authentication. |
| OWASP Agentic AI Top 10 | Agentic and automated systems that hold service credentials are exposed when hash reuse is possible. |
Reduce hash reuse by removing exposed secrets, rotating credentials, and limiting authentication pathways.
Related resources from NHI Mgmt Group
- Why do unsalted password hashes remain risky even when the hash function is strong?
- How should security teams handle password migration when a CIAM vendor will not disclose hash details?
- What breaks when password hash portability is missing during CIAM offboarding?
- Who is accountable when a CIAM vendor makes migration dependent on hidden hash details?
