Procedure examples

GALLIUM used dumped hashes to authenticate to other machines via pass the hash.

Kimsuky has used pass the hash for authentication to remote access software used in C2.

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.

APT32 has used pass the hash for lateral movement.

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.

The APT1 group is known to have used pass the hash.

Chimera has dumped password hashes for use in pass the hash authentication attacks.

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.

APT28 has used pass the hash for lateral movement.

Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.

FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.