Pass the Key, also called Overpass the Hash, is an attack where an adversary uses an NTLM hash or other secret to obtain a Kerberos ticket instead of presenting the password itself. It lets the attacker authenticate as the victim when hashes are stolen. Defenders should protect credential material and limit where Kerberos pre-authentication secrets can be captured.
How Pass the Key Works
Pass the Key, also called overpass the hash, is a credential abuse technique in which an attacker uses a captured NTLM hash or similar secret to request a Kerberos ticket. The password is never typed or revealed, but the stolen material is still enough to impersonate the victim.
The key security idea is that Kerberos does not always need the original password if the attacker already has the right pre-authentication material. That makes the technique especially dangerous after endpoint compromise, memory scraping, or any other event that exposes credential artifacts.
In practice, this attack sits close to other Windows authentication abuse patterns such as pass-the-hash and ticket abuse. The difference is that the adversary is using the hash or secret to obtain a fresh Kerberos ticket, then using that ticket as if it were legitimately issued to the victim.
Because the abuse happens through normal authentication machinery, it can look like ordinary logon activity unless defenders correlate authentication source, account behaviour, and ticket issuance details across endpoints and domain infrastructure.
Why It Is Dangerous
Pass the Key is dangerous because it turns stolen credential material into immediate authenticated access. Once an attacker can mint a Kerberos ticket, they may move laterally, access protected services, and operate under the victim’s identity without needing to recover the cleartext password.
This is particularly damaging in environments where privileged users, service accounts, or reused secrets are exposed on endpoints. If a high-value hash is captured, the attacker does not need an interactive password guessing phase, which shortens the path from compromise to misuse.
The risk is not limited to one machine. Kerberos tickets can unlock access across multiple systems and services, so a single exposed secret may create broader trust abuse than the original capture event suggests.
Hardening guidance in Kerberos Security Guide is especially relevant here because the technique depends on weaknesses in Kerberos handling, secret protection, and ticket abuse detection.
How Organisations Check Exposure
Exposure starts with knowing where credential material can be captured. Organisations should identify which endpoints, jump hosts, admin workstations, and server tiers can store or process Kerberos-related secrets, then review whether privileged sessions are isolated from general-use systems.
They should also check whether older authentication settings, broad admin rights, or inconsistent tiering make it easier to harvest reusable hashes. Systems with weak segmentation, shared admin access, or poor endpoint protection increase the chance that one compromised host leads to many usable secrets.
Detection teams should look for authentication patterns that do not fit the user’s normal workstation, logon time, or source host, especially where Kerberos ticket activity follows a suspicious endpoint compromise. Correlating Windows authentication logs with endpoint telemetry helps reveal whether ticket requests came from an expected privileged path or from an abused host.
For broader lateral movement context, Lateral Movement Guide helps map the technique to common post-compromise paths such as stolen-credential use and remote service abuse.
Remediation, Detection, and Recovery
Remediation focuses on stopping the attacker from reusing the captured material and on determining whether the environment has already been abused. If a hash or similar secret may be exposed, defenders should assume account activity may no longer be trustworthy until the affected credentials and related sessions are reviewed.
Detection should include alerts for abnormal Kerberos ticket requests, unusual service access after authentication, and signs that a ticket was obtained from an unexpected host. Endpoint and directory telemetry should be reviewed together, because the compromise may begin on one system and show impact on another.
After remediation, organisations should review whether any related privileged sessions, cached credentials, or administrative tokens were also exposed. If the attacker obtained a reusable secret, the blast radius often extends beyond the first victim account.
Identity Threat Detection and Response (ITDR) Guide is useful here because it frames pass-the-key behaviour as an identity attack that requires detection, investigation, and response, not just endpoint cleanup.
What to Protect First
The highest-priority control objective is to reduce the places where hashes and pre-authentication secrets can be captured or reused. That means limiting privileged logons on exposed systems, separating admin activity from standard user activity, and reducing the lifetime and reach of credential material wherever possible.
Defenders should treat reusable secrets as high-value assets, because the attack only works when those secrets remain available to the adversary. The more tightly Kerberos-related material is protected, the harder it becomes for an attacker to turn one compromise into authenticated domain access.
Lateral Movement Guide and Kerberos Security Guide together support that operational view: one explains the movement path, the other explains the authentication system being abused.
Risk and Threat Considerations
Pass the Key is risky because a stolen hash or equivalent secret can be transformed into a valid Kerberos authentication flow, which turns a single credential theft event into active impersonation. The attacker is not merely guessing access, they are reusing trust that the environment already grants to the victim.
Failure mechanism: The environment allows reusable credential material to be captured and then accepted as a basis for Kerberos ticket issuance, so compromised hashes can be converted into authenticated sessions and downstream lateral movement.
Impact: A compromised account can be used for impersonation, privilege abuse, and access to multiple dependent systems, often without the cleartext password ever being known.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1550.002 — Use Alternate Authentication Material: Pass the Hash | Covers reuse of captured authentication material to obtain access without the cleartext secret. |
| Recommendation — Map ticket-issuance anomalies to alternate-authentication abuse and hunt for credential reuse across hosts. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Applies because the term depends on protecting and managing reusable authentication material and its lifecycle. |
| IA-2 — Identification and Authentication (Organizational Users) | Applies because the attack abuses user authentication to impersonate a victim account. | |
| AC-6 — Least Privilege | Applies because limiting administrative reach reduces the value of stolen hashes and ticket abuse. | |
| Recommendation — Enforce authenticator handling, rotation, and revocation for reusable credential material. Correlate anomalous Kerberos authentication with the user and workstation that should have initiated it. Restrict privileged logon paths so a captured secret cannot unlock broad domain access. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Covers insecure use of secrets that lets attackers authenticate as another principal. |
| NHI-02 — Secret Leakage | Applies because the attack requires credential material to be exposed or extracted first. | |
| NHI-05 — Overprivileged NHI | Applies when reusable secrets belong to accounts with excessive reach or privilege. | |
| Recommendation — Review authentication paths that let stolen secrets mint valid sessions or tickets. Reduce where hashes and related secrets can be exposed, cached, or harvested. Limit the privilege attached to reusable secrets so compromise does not become domain-wide access. | ||
| CIS Controls v8 | 5 — Account Management | Applies because account lifecycle and privileged account hygiene determine blast radius after secret theft. |
| Recommendation — Tighten privileged account handling and remove standing access that amplifies credential abuse. | ||
Practitioner Guidance
What to watch for: Treat this term as a signal to review where hashes, tickets, and pre-authentication material can be harvested, especially on systems that handle privileged logons. If ticket issuance, endpoint compromise, and account behaviour do not line up, investigate for identity misuse rather than assuming ordinary logon traffic.
Governance implication: The accounts and systems that can generate or reuse Kerberos trust should be owned as high-risk authentication assets, with explicit controls around where they can be used and how quickly they can be rotated or invalidated after compromise.