Overpass the Hash is a post-exploitation technique where an attacker uses a stolen NTLM hash to authenticate and obtain Kerberos tickets. It turns hash theft into a usable login session, allowing access as the compromised user without needing the plaintext password. The technique is especially dangerous in Active Directory environments that still rely on NTLM.
How Overpass the Hash Works
Overpass the Hash is a post-exploitation pivot from credential theft to authenticated access. The attacker does not need the plaintext password once the NTLM hash is stolen, because the hash can be used to begin an authentication flow and obtain Kerberos tickets, turning one captured secret into a working session.
This matters because the technique abuses normal Windows authentication paths rather than forcing a noisy password guess. In Active Directory environments, that makes stolen hashes especially valuable when NTLM remains available and the attacker can reach a system where Kerberos is accepted.
Why It Is Dangerous in Active Directory
The danger is not the hash alone, but the authority attached to the account represented by that hash. If the compromised account has broad access, the attacker can inherit those privileges without triggering a password reset event in the same way a plaintext password compromise would.
Overpass the Hash is closely related to other credential replay and ticket abuse patterns, so defenders should treat it as part of the wider NTLM-to-Kerberos abuse problem. The practical impact is often lateral movement, reuse of existing trust, and faster expansion from one host compromise into a domain-level incident.
How Organisations Check Exposure
Exposure review starts with knowing where NTLM is still accepted, which systems are domain-joined, and which administrative paths can be reached from a compromised workstation. The most useful questions are whether NTLM is still enabled for key services, whether privileged accounts can log on where they should not, and whether ticket-based access is monitored closely enough to spot unusual use.
The right validation sources are asset inventory, authentication telemetry, and vendor guidance for Windows hardening. Pass-the-Hash and Pass-the-Ticket Guide is a useful defender reference for the related NTLM-restriction, Protected Users, LAPS, and detection considerations, while Kerberos Security Guide covers the ticketing side of the same trust chain.
Remediation and Detection
Once this technique is in scope, remediation is about reducing the value of stolen hashes and limiting where they can be replayed. That means shrinking NTLM use, tightening administrative logon paths, and reducing standing privilege so a stolen credential cannot easily become a domain-wide foothold.
Detection should focus on authentication patterns that do not fit the user or host history, especially unusual logon context, ticket issuance behaviour, and follow-on movement after a suspected credential theft event. Review the systems touched after compromise, because a successful overpass often leaves the first visible signal only after the attacker has already moved past the initial host.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1550.002 — Use Alternate Authentication Material: Pass the Hash | Defines hash replay as alternate auth material used to gain access |
| Recommendation — Map hash replay activity to T1550.002 and hunt for lateral movement after credential theft. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle controls reduce the value of stolen hashes and tickets |
| IA-2 — Identification and Authentication (Organizational Users) | Organizational logon controls govern the user sessions abused in overpass attacks | |
| AC-6 — Least Privilege | Least privilege limits how much access a stolen hash can unlock | |
| Recommendation — Enforce IA-5 to manage, rotate, and invalidate authenticators that could be replayed. Apply IA-2 to strengthen user authentication and constrain reusable logon material. Use AC-6 to minimize the access obtained from a compromised account. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | CIS access control guidance directly addresses excessive and reusable access paths |
| Recommendation — Use CIS-6 to reduce standing access and remove unnecessary account reach. | ||
| NIST CSF 2.0 | PR.AA-05 — Authentication | CSF authentication guidance supports stronger user verification and session trust |
| DE.CM-01 — Networks and network services are monitored | Monitoring authentication and network activity helps spot post-exploitation movement | |
| ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded | Identifying NTLM exposure and reachable assets is central to overpass risk review | |
| Recommendation — Implement PR.AA-05 to harden authentication paths that attackers try to replay. Use DE.CM-01 to monitor for unusual authentication and lateral movement patterns. Use ID.RA-01 to inventory where NTLM and replayable access paths still exist. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Replayable authentication material is the core weakness abused by this technique |
| NHI-05 — Overprivileged NHI | The technique is far more damaging when the stolen account has broad privilege | |
| Recommendation — Treat replayable hash-based access as an authentication weakness and remove it where possible. Reduce privilege so a stolen hash cannot unlock excessive access. | ||
Practitioner Guidance
Why practitioners should care: Overpass the Hash is a strong indicator that password-based trust has already been bypassed, so the real question is how far the attacker can move with the session they gained. The response should focus on containing the account’s reach, not only replacing the password that was never used in plaintext.
What to watch for: Treat the technique as a cue to review privileged logons, NTLM dependence, and whether the same account can be reused across multiple systems without strong separation. Where the environment still relies on legacy authentication, the attacker’s advantage is persistence through reuse, not a single stolen value.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org