CAPEC-644 Use of Captured Hashes (Pass The Hash)

abstraction: detailedstatus: active

An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.

likelihood: Mediumseverity: High

weaknesses (4)

The CWE weakness classes this flaw belongs to.

CWE-294Authentication Bypass by Capture-replay
CWE-308Use of Single-factor Authentication
CWE-522Insufficiently Protected Credentials
CWE-836Use of Password Hash Instead of Password for Authentication

ATT&CK techniques

ATT&CK techniques this enables or maps to.

T1550.002Pass the Hash

related attack patterns (1)

Related entries.

CAPEC-653Use of Known Operating System Credentials

source

Where this definition is published.

MITRE CAPEC