{'created': '2020-01-30T16:36:51.184Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may “pass the hash” using stolen password hashes '
                'to move laterally within an environment, bypassing normal '
                'system access controls. Pass the hash (PtH) is a method of '
                "authenticating as a user without having access to the user's "
                'cleartext password. This method bypasses standard '
                'authentication steps that require a cleartext password, '
                'moving directly into the portion of the authentication that '
                'uses the password hash.\n'
                '\n'
                'When performing PtH, valid password hashes for the account '
                'being used are captured using a [Credential '
                'Access](https://attack.mitre.org/tactics/TA0006) technique. '
                'Captured hashes are used with PtH to authenticate as that '
                'user. Once authenticated, PtH may be used to perform actions '
                'on local or remote systems.\n'
                '\n'
                'Adversaries may also use stolen password hashes to "overpass '
                'the hash." Similar to PtH, this involves using a password '
                'hash to authenticate as a user but also uses the password '
                'hash to create a valid Kerberos ticket. This ticket can then '
                'be used to perform [Pass the '
                'Ticket](https://attack.mitre.org/techniques/T1550/003) '
                'attacks.(Citation: Stealthbits Overpass-the-Hash)',
 'external_references': [{'external_id': 'T1550.002',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1550/002'},
                         {'description': 'Warren, J. (2019, February 26). How '
                                         'to Detect Overpass-the-Hash Attacks. '
                                         'Retrieved February 4, 2021.',
                          'source_name': 'Stealthbits Overpass-the-Hash',
                          'url': 'https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/'}],
 'id': 'attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'lateral-movement'}],
 'modified': '2025-10-24T17:49:32.459Z',
 'name': 'Pass the Hash',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Blake Strom, Microsoft 365 Defender',
                          'Travis Smith, Tripwire'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.3'}

---

---

---

---