How do you detect pass-the-hash attacks on Windows?

What pass-the-hash looks like in Windows telemetry

Pass-the-hash is easiest to spot when Windows authentication patterns stop looking like normal user behaviour. Focus on NTLM logons that originate from unusual hosts, appear in bursts across multiple systems, or are followed quickly by remote administration activity. The signal is rarely one event on its own, it is a cluster of authentication and lateral movement indicators that line up in time.

A good detection rule starts with the account, the source host, and the destination host. If the same privileged account is authenticating from several different machines in a short window, or if a workstation suddenly begins making admin-style connections to servers, that is materially more suspicious than a single NTLM login.

Which host and account patterns matter most

The strongest pattern is credentials being reused from a compromised endpoint to reach other Windows systems. That usually shows up as lateral movement, often with a privileged account, and sometimes with remote service creation soon after authentication. The Lateral Movement Guide is useful here because pass-the-hash often sits inside the same operational pattern as SMB admin share use, PsExec, WMI, WinRM, and related Windows administration paths.

Look for a mismatch between the source machine and the role of the account. Domain admins, server admins, and service accounts should not normally authenticate from arbitrary user endpoints, nor should they appear to hop across systems in a way that mirrors operator tooling. When those accounts do so, you should treat it as a likely compromise path until proven otherwise.

How to separate suspicious NTLM use from normal administration

NTLM by itself is not proof of pass-the-hash, but repeated NTLM use from unusual sources is a high-value warning sign when paired with lateral movement and service creation. Remote service creation is especially important because attackers often use it to turn a successful authentication into execution on the next host. That makes the authentication event and the follow-on action part of the same detection story.

Identity Threat Detection and Response (ITDR) Guide helps frame the problem as an identity attack sequence rather than a single log event. In practice, that means correlating NTLM logons, privileged account use, host-to-host movement, and post-authentication actions such as service creation, remote process execution, or unusual administrative share access.

For deeper context on why stolen hashes are so dangerous in Windows environments, Cisco Active Directory credentials leak 2025 is a relevant example of how exposed hashes and privileged accounts can widen lateral movement exposure once they are usable on the network.

Risk and Threat Considerations

Pass-the-hash matters because it turns one compromised Windows host into a reusable authentication source. Once an attacker has a hash that works for NTLM, they can often move laterally without needing the cleartext password, which makes privileged account reuse and weak host segmentation especially dangerous.

Failure mechanism: A compromised endpoint is used to replay NTLM-based credentials to other Windows systems, often with the same account appearing across multiple hosts and then being used for remote service creation or other administrative activity.

Impact: The attacker can escalate reach across the environment, compromise additional servers, and gain persistence or broader administrative control before defenders notice the original endpoint compromise.

Practitioner Guidance

What to prioritise: Start with privileged accounts and then expand to accounts that authenticate from workstations but normally administer servers. If you can only investigate one slice first, choose the accounts that would create the largest blast radius if reused through NTLM.

What to verify: Confirm whether the source host should ever authenticate to the destination host, whether the account normally uses NTLM, and whether the post-logon activity matches expected administration. A suspicious login becomes more convincing when it is followed by service creation, admin share access, or repeated use of the same account from different machines.

Practitioner takeaway: Treat pass-the-hash as a correlation problem, not a single-signature problem, and prioritise detection logic that joins authentication, source host trust, and follow-on lateral movement into one investigation path.

Related resources from NHI Mgmt Group

• Why do shared local administrator passwords increase the risk of pass the hash attacks in Windows environments?
• Why should LM hash storage be disabled on Windows, and how do you detect it being re-enabled?
• How do you detect Kerberos relay attacks such as KrbRelayUp on Windows?
• How do you detect NTLM brute force attacks on Windows domains?