Pass-the-Hash uses a captured password hash to authenticate without knowing the cleartext password, most commonly in NTLM-based environments. Pass-the-Ticket reuses a stolen Kerberos ticket to impersonate a user until the ticket expires. Defenders should look for unusual lateral movement, ticket reuse, and credential exposure, and reduce both risks with least privilege and strong credential hygiene.
How Pass-the-Hash and Pass-the-Ticket differ operationally
Pass-the-Hash and Pass-the-Ticket are both credential-reuse techniques, but they abuse different authentication material and different trust assumptions. Pass-the-Hash relies on a captured password hash to satisfy NTLM authentication without knowing the cleartext password. Pass-the-Ticket reuses a stolen Kerberos ticket, which means the attacker is leveraging an already-issued Kerberos trust artifact rather than deriving one from the password.
The practical difference matters because the defender’s response is not identical. Hash abuse points you toward Windows credential exposure, NTLM usage, and lateral movement paths that accept hash-based authentication. Ticket abuse points you toward Kerberos session artifacts, ticket lifetime, and places where a valid ticket can be replayed before expiry. Lateral Movement Guide is useful here because both techniques commonly appear in the same lateral movement chain.
In both cases, the attacker is not “breaking” the protocol in the abstract, they are replaying something the environment already trusts. That is why these techniques often succeed after initial compromise, especially when local admin reuse, weak segmentation, or poor credential hygiene lets one compromise become many.
Why the credential artifact changes the attack path
Pass-the-Hash is fundamentally about password-derived material. If the environment still accepts NTLM authentication broadly, a stolen hash can be enough to move laterally without ever recovering the password itself. The key operational point is that the hash behaves like an authentication secret, so exposure of that secret can be as damaging as exposure of the password in many Windows environments.
Pass-the-Ticket is different because the attacker is using a Kerberos ticket that was already minted by the Key Distribution Center. The ticket typically encodes authorization context and remains usable until it expires, so the window of abuse is bounded by ticket lifetime rather than by password reset alone. Kerberos Security Guide is the more relevant deeper reference for understanding ticket abuse, golden and silver ticket patterns, and ticket-related detection.
The difference in artifact also affects visibility. Hash reuse may show up as successful NTLM logons across systems that would not normally share that credential path. Ticket reuse may show up as anomalous Kerberos activity, repeated use of a valid ticket from an unusual host, or signs that a ticket has been copied and replayed outside the expected user context.
What defenders should look for in each case
For Pass-the-Hash, the strongest signals are unusual lateral movement, repeated NTLM authentication from the same source, and privilege use that does not fit the normal workstation-to-server pattern. For Pass-the-Ticket, watch for suspicious Kerberos ticket use, especially where a user appears active from multiple hosts or where access persists even after the initial compromise should have been contained. Identity Threat Detection and Response (ITDR) Guide is directly relevant because it ties identity attack techniques to the detections and response actions that matter.
Both techniques benefit from the same broad control logic, but the investigative emphasis differs. If the artifact is a hash, check where credentials were dumped, cached, or reused. If the artifact is a ticket, check where Kerberos material may have been stolen, duplicated, or replayed, and whether the ticket lifetime allowed the abuse to continue after the first alert. In either case, the compromise is usually larger than one account if administrators or service accounts were involved.
Risk and Threat Considerations
These techniques are dangerous because they turn one credential exposure into authenticated access that can look legitimate to downstream systems. The main risk is not the initial theft, but the speed with which an attacker can convert that theft into lateral movement, privilege expansion, or persistence before the original account is reset or disabled.
Failure mechanism: Pass-the-Hash succeeds when NTLM remains accepted and a captured hash can be reused as a valid authenticator. Pass-the-Ticket succeeds when a stolen Kerberos ticket can be replayed before expiry, often with enough trust context to impersonate the victim effectively.
Impact: A single exposed hash or ticket can enable remote access, movement between hosts, and repeated abuse of the same identity until the credential material is invalidated or the session path is broken. In practice, the blast radius is often determined by privilege level, shared credentials, and how quickly the environment detects anomalous authentication reuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Pass-the-Hash and Pass-the-Ticket often enable remote lateral movement. |
| T1550 — Use Alternate Authentication Material | Both techniques reuse stolen authentication material instead of fresh credentials. | |
| Recommendation — Map remote logons to T1021 and hunt for anomalous service access across hosts. Track reuse of hashes and tickets under T1550 and correlate with impossible logons. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Hash and ticket abuse depend on weak lifecycle control over authenticators and session material. |
| AC-6 — Least Privilege | Limiting privilege reduces the blast radius of reused hashes or tickets. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing authentication and lateral movement telemetry. | |
| Recommendation — Rotate, protect, and invalidate authenticators quickly when compromise is suspected. Restrict privileged access so stolen authentication material cannot reach broad systems. Review authentication logs for reuse patterns and unusual source-to-target combinations. | ||
Practitioner Guidance
What to prioritise: Treat these as detection-and-containment problems first, not just authentication hygiene issues. If the compromised material can authenticate to production systems, prioritise blast-radius reduction, session invalidation where possible, and review of lateral movement paths before assuming the compromise is limited to one host.
What to verify: Confirm which authentication protocols are still accepted, where privileged credentials are cached, and whether Kerberos tickets or password-derived material could still be valid on adjacent systems. The difference matters because a password reset alone may not immediately stop ticket-based abuse, while removing NTLM exposure may sharply reduce hash-based reuse.
Practitioner takeaway: The deciding factor is the trust artifact being replayed, because that determines both the attacker’s reach and the defender’s fastest containment path.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between SAST and DAST for security teams?
- What is the difference between password hash synchronisation and pass-through authentication in a hybrid Active Directory setup?
- How should teams respond when a secret is found in a support ticket?