Pass the Cache is an attack technique that abuses cached Kerberos material on a host to impersonate a user without knowing the original password. It targets systems that retain reusable authentication data and can enable lateral movement. Defenders should protect cache contents, reduce credential retention and watch for suspicious use of cached tickets or tokens.
How Pass the Cache Works
Pass the Cache is a credential abuse technique that turns locally stored Kerberos material into a usable impersonation path. Instead of recovering a password, the attacker relies on authentication data already present on the host, which makes the technique effective when reusable tickets or similar cache entries remain accessible.
The technique matters because it shifts the problem from password guessing to session or ticket theft. If an adversary can reach a workstation, server, or jump host with cached material, they may be able to act as the victim until the cache expires, is invalidated, or is removed.
Why Cached Kerberos Material Is Valuable to Attackers
Kerberos caches are attractive because they can preserve a live path into a network after the original sign-in has already happened. That means the defender may have already done the hard work of authenticating the user, while the attacker only needs access to the host and the stored artefact.
This technique is especially useful in environments where administrators, remote workers, or service operators reuse the same endpoints for privileged activity. A cached ticket or token can become a bridge into higher-value systems without any new password capture.
NHIMG’s Lateral Movement Guide is the best companion reference when you want to place Pass the Cache in the wider movement path that includes remote services and stolen credentials.
How Organisations Check Exposure
Exposure starts with inventory: which hosts retain Kerberos cache material, which users log on interactively, and which systems are likely to hold privileged sessions long enough to matter. The next question is whether those hosts are reachable by untrusted users, shared across teams, or exposed through weak workstation segmentation.
Vendor guidance and platform hardening guidance are also important because cache handling is partly an operating-system and configuration issue. Defenders should confirm whether cached material is retained longer than necessary, whether sensitive accounts are allowed to sign in where they should not, and whether monitoring can distinguish normal ticket use from suspicious reuse.
For broader control design, NIST SP 800-53 Rev 5 Security and Privacy Controls helps map the surrounding access control, authentication, logging and configuration requirements that reduce cache-abuse exposure.
NIST SP 800-207 Zero Trust Architecture is useful here because limiting implicit trust between hosts and tightening access paths makes cached material less useful as a lateral-movement shortcut.
Remediation and Detection After Use
If Pass the Cache is suspected, remediation is not only about the endpoint. The defender should assume the cached material may already have enabled reuse elsewhere, so review authentication logs, host access patterns and any follow-on remote activity that occurred from the affected system.
Detection should focus on unusual ticket presentation, suspicious remote execution, and cache use that does not match the expected user context or timing. A compromised host may show signs that a legitimate session was reused to reach file shares, admin interfaces or remote services that the original user would not normally touch.
When the behaviour resembles a wider intrusion sequence, the attack path aligns closely with credential access and lateral movement patterns described in MITRE ATT&CK Enterprise Matrix.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1550 — Use Alternative Authentication Material | Pass the Cache reuses cached Kerberos material to authenticate as a user. |
| Recommendation — Hunt for cached-ticket reuse and correlate it with lateral movement from the affected host. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Cached tickets and tokens are reusable authenticators that need lifecycle control and protection. |
| AU-2 — Event Logging | Detecting cache abuse depends on logs that show unusual authentication and remote activity. | |
| Recommendation — Apply IA-5 to limit retention, protect cached authenticators and revoke them when exposure is suspected. Log ticket use, remote access and privileged session activity to spot suspicious reuse patterns. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero trust reduces implicit host-to-host trust that makes cached material useful for lateral movement. |
| Recommendation — Reduce implicit trust between hosts so cached authentication material is less useful for lateral movement. | ||
Practitioner Guidance
What to watch for: Treat Pass the Cache as a host-level reuse problem, not just a password problem. The practical control objective is to shorten the lifetime of reusable authentication material, reduce where it can be stored, and make privileged session reuse harder to hide.
Governance implication: Teams that manage privileged endpoints should own both the cache-retention policy and the detection logic that proves those caches are not becoming an unauthorised access path. The same system can be compliant on paper and still expose reusable Kerberos material if operational controls are loose.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org