What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Treat a Pass-the-Hash (PtH) alert as a lead, not proof. Preserve the alert and surrounding telemetry, build a timeline of the account, source device, destination and process activity, then contain the identity and affected systems using known-good administration. Do not begin with a password reset on a potentially compromised computer: replacement credentials can be captured there.
MITRE ATT&CK defines the technique this way: “Pass the hash (PtH) is a method of authenticating as a user without having access to the user’s cleartext password.” The investigation therefore focuses on stolen authentication material, where it was used, what access it gained and whether the attacker reached identity infrastructure.
As an Amazon Associate I earn from qualifying purchases.
What a Pass-the-Hash attack is—and what an alert does not prove
Pass the Hash is MITRE ATT&CK sub-technique T1550.002, under Use Alternate Authentication Material in the Lateral Movement tactic. An attacker who obtains a valid password hash can authenticate as that user without learning the cleartext password. The reused material may come from a workstation, server, memory, credential store or another compromised system.
PtH is not password guessing. A failed guessing campaign produces authentication failures as an attacker tries possible passwords; PtH reuses authentication material that has already been obtained. A related technique, “overpass the hash,” uses hash material to obtain a Kerberos ticket. Consequently, an investigation may need to correlate both NTLM and Kerberos activity.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An anomalous NTLM logon, an SMB alert or a Microsoft Defender for Identity alert is an investigative signal. NTLM is also used by legitimate applications, administration tools and compatibility paths, so the protocol alone cannot establish PtH. Product alerts, event records and endpoint detections must be compared with the account’s normal source, time, target and process behavior.
First response: preserve evidence while reducing access
Use a coordinated incident process. The order below is designed to stop additional lateral movement without destroying the evidence needed to understand scope.
- Open an incident record. Preserve the original alert, event identifiers, timestamps, time zones, affected entities, endpoint telemetry and identity records. Record who collected each item and where it was stored so the evidence chain remains clear.
- Use a known-good administrative path. Do not investigate or reset credentials from a workstation or server that may be controlled by the attacker. Use a trusted administrative system, emergency access procedure or isolated management path.
- Identify the suspected identity and first source. Record the account, source host, destination host, service, authentication protocol, logon type and the earliest suspicious timestamp. Include local and domain account distinctions.
- Contain the identity. Disable an account believed compromised, prioritizing privileged identities, or otherwise block its use according to your identity-response procedure. Coordinate with service owners first when the account supports essential systems, and use a known-good replacement administrator for recovery.
- Isolate affected computers. Remove likely compromised endpoints and servers from normal network access while preserving their state for examination. Microsoft incident-response guidance says not to turn an isolated compromised system off; if operational safety requires a different action, document the reason and obtain incident-lead approval.
- Look for control-plane exposure. Check whether domain controllers, identity-management systems, backup infrastructure, management servers or privileged administration hosts were touched before declaring that the incident is limited to a workstation.
Containment and evidence collection are parallel activities. Delaying all containment until every event is reviewed can give an attacker more time, while immediately wiping or powering off systems can remove the facts needed to determine what happened.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build a timeline from Windows and identity telemetry
Start with the alert’s entities and context, then pivot in both directions from the suspected authentication. MITRE’s DET0409 detection strategy recommends correlating account context, source and destination systems, session creation, process activity and network activity. The following records are useful when the organization’s audit policy, Sysmon configuration and retention period made them available at the relevant time.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Telemetry | What to examine | How it helps |
|---|---|---|
| Security event 4624 | Successful logon account, source network address, workstation name, authentication package, logon type and time | Shows where an identity successfully established a session and whether the source and destination fit normal use. |
| Security event 4648 | Use of explicit credentials, requesting process and target account | Connects a credential-use action to a process and user context; investigate unexpected administrative tools or scripts. |
| Kerberos event 4768 | Ticket-granting-ticket request, account, client address and time | Helps identify Kerberos activity adjacent to suspected overpass-the-hash or other alternate-authentication use. |
| Sysmon event 1 | Process creation, parent process, command line, integrity level and user | Places a suspicious authentication beside the process that may have initiated it. |
| Sysmon event 3 | Network connection, initiating process, source and destination | Links a process and endpoint to lateral connections and their timing. |
| Sysmon event 22 | DNS query, requesting process and queried name | Adds name-resolution context to remote connections and unusual destinations. |
Event numbers are not guarantees. A missing record may mean the relevant audit subcategory was disabled, the endpoint was not running Sysmon, logs were overwritten, the source was outside the collection boundary or clocks were inconsistent. State what is actually available and avoid treating an absent event as proof that an action did not occur.
Construct the authentication timeline
- Normalize timestamps to a single reference time while retaining the original time zone and source.
- Place the initial alert, the account’s successful and failed logons, Kerberos requests, process starts and network connections on one timeline.
- For each successful session, record source device, destination device, service, logon type, authentication package and account privilege.
- Pivot from every suspicious source and destination to adjacent activity for a period appropriate to your retention and incident window. Look for repeated use of the same account, rapid host-to-host movement or a new administrative pattern.
- Compare the observed sequence with the account’s baseline: usual workstations, hours, applications, administrative tier and destinations.
Look for execution and persistence after authentication
A PtH session matters because it can enable remote execution or administration. Correlate the logon with process creation, service creation, scheduled-task changes, remote-management activity, new local or domain accounts, group-membership changes and unusual access to file shares or management systems. Also inspect outbound connections from the source host for credential-access tooling, command-and-control indicators or connections to additional endpoints.
How to decide whether the activity is really suspicious
Use multiple independent indicators rather than a single NTLM record. A stronger case combines an unusual source device or time, an account that normally does not use NTLM, a destination outside the account’s role, a process or service that appeared immediately before the session, and subsequent administrative or lateral activity.
- Account context: Is the identity privileged, shared, a service account or normally restricted to a particular tier?
- Source context: Is the source a workstation, server, jump host or device the account has never used?
- Destination context: Did the account reach a server, domain controller, backup system or management plane outside its normal responsibilities?
- Protocol context: Is NTLM expected for this application, or is it a new fallback where Kerberos would normally be used?
- Process context: Did a new or unsigned process, unexpected parent process, service or scheduled task precede the network session?
- Sequence context: Did one authentication lead to additional hosts, privilege changes, persistence or credential-access activity?
Legitimate explanations must be tested, not assumed. Legacy applications, disconnected systems, service accounts and help-desk workflows can generate unusual NTLM use. Document the owner’s explanation and verify it against the source, destination, process and timing. Conversely, a familiar account name does not make activity safe: attackers often reuse a legitimate identity precisely to blend into normal logs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Scope the incident before declaring containment
Microsoft incident-response guidance frames scope around compromised accounts, affected devices and affected applications. Apply that model systematically.
Accounts and secrets
- List every account seen on the suspected source and destinations during the incident window.
- Separate ordinary users, local administrators, domain administrators, service identities, scheduled-task accounts and emergency accounts.
- Identify credentials reused across multiple hosts, shared local administrator passwords and accounts with delegated rights.
- Check for new accounts, group-membership changes, privilege assignments and altered authentication settings.
Devices and tiers
- Map the first suspected endpoint, every destination it contacted and every host that later used the same account.
- Prioritize domain controllers, identity-management servers, backup systems, software-deployment servers, virtualization management and administrative jump hosts.
- Determine whether any device was already compromised before the earliest alert; the first alert is not necessarily the start of the intrusion.
Applications and data paths
- Identify file shares, databases, remote-management services and line-of-business applications reached with the identity.
- Ask application owners whether the account’s observed access was expected and whether the application stores or forwards credentials.
- Review sensitive data access and administrative changes separately from ordinary authentication so a successful logon is not mistaken for proof of data theft.
Preserve uncertainty explicitly. If telemetry starts after the suspected first use, state that the earliest confirmed event is only a lower bound and keep the investigation window open until retention, host images and identity records have been reviewed.
Containment choices and their trade-offs
Containment should reduce the attacker’s ability to reuse credentials while keeping essential services available. Coordinate actions with identity, endpoint, server and application owners.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Disable or restrict the account: Fastest way to stop a known identity, but it can interrupt services and will not stop an attacker using another account or already-established session.
- Isolate a host: Limits further movement and preserves the system for examination. Confirm that isolation does not sever a safety, medical or other essential function without an approved alternative.
- Block a destination or protocol path: Can protect a high-value server while preserving the source for evidence, but broad authentication changes may break legacy applications.
- Revoke sessions and tickets where supported: Useful after identity containment, but implementation and propagation vary; verify that existing sessions, service credentials and cached material are no longer usable.
- Protect the administrative tier: Move recovery work to known-good management systems and prevent ordinary workstations from administering higher-trust systems.
Do not rely on a single action as eradication. A password reset may leave an attacker with another compromised account, a persistence mechanism or access from an already-controlled host. Isolation, credential remediation, persistence checks and validation must be treated as separate tasks.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Credential remediation without creating new exposure
Reset or rotate credentials according to the exposure path and confirmed scope. Prioritize privileged credentials, identities reused on several hosts and secrets that may have been present on the suspected source. Perform the work from a known-good administrative system; a compromised computer can capture replacement credentials as they are entered.
Plan the rotation
- Enumerate domain, local, service, scheduled-task, application-pool and automation credentials associated with affected systems.
- Identify dependencies and maintenance windows before changing service or application secrets.
- Rotate the highest-risk privileged credentials first, then identities with broad host reuse, followed by affected user and service accounts.
- Verify that old credentials no longer authenticate and that services have recovered with the new secrets.
- Continue monitoring for attempts using the old material; attempted reuse can reveal unexamined hosts or delayed persistence.
Do not rotate every secret indiscriminately without understanding dependencies. Include local administrator passwords, service accounts and other secrets when the investigation indicates exposure or reuse, and record exceptions with an owner and a deadline.
Reduce credential overlap
MITRE’s mitigations emphasize limiting credential overlap and avoiding the use of domain users as local administrators across multiple systems. Give administrative identities narrowly defined scopes, separate workstation and server administration, and prevent the same powerful credential from being valid on unrelated hosts. These changes reduce the blast radius when one hash is stolen.
Use Windows LAPS for local administrator passwords
Windows LAPS automatically manages local administrator password rotation and is documented by Microsoft as a defense against Pass-the-Hash and lateral-traversal attacks. It addresses the risk of one shared local administrator password working across many computers. LAPS does not clean a compromised device, invalidate a compromised domain account or prove that an attacker has been removed. Deploy it with appropriate directory permissions, recovery procedures and monitoring for password retrieval.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Eradication, recovery and validation
After containment and credential changes, examine each affected system for persistence and unauthorized changes. Check scheduled tasks, services, startup mechanisms, local users, group membership, remote-access configuration, security-policy changes and management agents. Inspect identity infrastructure for new delegation, altered trust or policy settings, suspicious administrative sessions and unauthorized changes to domain controllers.
Rebuild a system when its integrity cannot be established, when privileged credentials were exposed on it or when persistence cannot be confidently removed. Preserve required forensic material before reimaging according to your incident process. Restore only from trusted sources, apply current security updates and enroll the device in monitoring before returning it to a privileged network segment.
Validate recovery with evidence rather than elapsed time. Confirm that the affected accounts authenticate only from expected locations, old credentials fail, isolated hosts no longer generate suspicious traffic, administrative changes match approved records and no additional hosts show the same pattern. Keep heightened monitoring long enough to cover delayed tasks, service restarts and normal credential-expiration cycles.
Controls to deploy after the incident
Credential Guard, Windows LAPS, Remote Credential Guard and passwordless methods address different attack paths. Compare them by the secret they protect, where they are supported, compatibility constraints and the operational work required.
| Control | Primary protection | Important limits and prerequisites | Best use |
|---|---|---|---|
| Credential Guard | Uses virtualization-based security to isolate protected NTLM and Kerberos secrets. | Support depends on specified Windows client and server versions, hardware and configuration. Compatibility requirements matter, and it does not protect the Active Directory database on domain controllers. | Reduce credential-theft exposure on eligible clients and servers after validating applications and recovery access. |
| Windows LAPS | Rotates local administrator passwords so one shared local secret is not reused across hosts. | Requires correct directory permissions, deployment and retrieval controls. It does not remediate a compromised domain account or establish that a device is clean. | Limit local-account credential reuse and lateral spread across managed Windows devices. |
| Remote Credential Guard | Limits exposure of user credentials to a remote target during supported Remote Desktop connections. | Requires supported scenarios, including Kerberos authentication and a domain-joined target. It is not a general PtH cleanup mechanism. | Protect credentials during approved RDP administration where its requirements are met. |
| FIDO2 security keys, Windows Hello for Business or smart cards | Add passwordless authentication methods that reduce reliance on reusable passwords. | Deployment, enrollment, recovery and application support must be planned. A key does not isolate a host, collect evidence or rotate already exposed credentials. | Strengthen long-term identity assurance alongside endpoint and administrative-tier controls. |
Microsoft recommends passwordless methods such as Windows Hello for Business, FIDO2 security keys and smart cards in addition to credential protections. Introduce them through a tested rollout, with break-glass access and account-recovery procedures, rather than during an uncontrolled response as a substitute for containment.
Detection improvements for the next investigation
Make future PtH investigations faster by ensuring the evidence exists before an incident. Collect Security events 4624, 4648 and 4768 where appropriate, deploy endpoint process and network telemetry such as Sysmon events 1, 3 and 22, synchronize clocks and retain logs long enough to cover your incident-detection window. Define expected NTLM use for legacy applications and alert on deviations rather than treating every NTLM event as malicious.
Build detections that join identity, endpoint and network data: an unusual NTLM logon from a workstation, no expected domain-logon context, a new source-to-destination relationship, a privileged account used from an atypical host, or process and service activity immediately following authentication. Microsoft Defender for Identity documents suspicious SMB NTLM authentication and suspected Pass-the-Hash alert scenarios; use those alerts as pivots and corroborate them with host and domain telemetry.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Common mistakes and safer alternatives
- Mistake: treating an alert as confirmation. Alternative: corroborate protocol, source, destination, process, account role and follow-on activity.
- Mistake: resetting a password on the suspect computer. Alternative: use known-good administration and assume replacement credentials could be captured until the host is contained.
- Mistake: powering off an isolated system immediately. Alternative: preserve its state unless incident leadership documents an overriding safety or operational reason.
- Mistake: resetting only the named user. Alternative: scope reused local, service, scheduled-task and privileged credentials and rotate those indicated by exposure.
- Mistake: assuming Credential Guard protects the entire domain. Alternative: check supported versions and compatibility, and remember that the Active Directory database on domain controllers is outside its protection.
- Mistake: deploying broad authentication changes without testing. Alternative: validate legacy applications, service dependencies, emergency access and rollback before enforcing controls.
- Mistake: declaring recovery because no new alert appeared. Alternative: verify old credentials fail, persistence is removed, administrative changes are understood and affected hosts remain clean under continued monitoring.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
