Active › Module 5 › Lesson 3
PtH PtT Named
Pass-the-Hash and Pass-the-Ticket name credential reuse classes — defender mitigations on $LAB_AD; no PtH cookbooks on production.
Visual · t25_pth_ptt_named
PtH/PtT class literacy. $LAB_AD only. Original Cyberlium.
Opening
PtH reuses NTLM hash material; PtT reuses Kerberos tickets — defenders segment, monitor, and harden endpoints.
Pass-the-Hash (PtH): NTLM hash used for authentication without plaintext password — often after credential access on endpoint. Pass-the-Ticket (PtT): stolen Kerberos ticket (TGT or TGS) reused on another session. Both are named lateral movement classes — mitigated by Credential Guard, Protected Users, short ticket lifetimes, LAPS, tiering, and 4624/4769 monitoring. Cyberlium names PtH/PtT with mitigations on YOUR $LAB_AD — not Mimikatz/secretsdump cookbooks against stranger domains or production credential dumping guides. Next: Auth Abuse Lab.
1. PtH class (named, mitigation focus)
Material: NTLM hash from LSASS or SAM on compromised endpoint (defenders prevent dump with Credential Guard, PPL, EDR, admin tiering). Reuse: SMB/WMI/WinRM auth with hash — monitor 4624 logon type 3 anomalies and NTLM restrictions.
Forbidden: secretsdump/Mimikatz step-by-step on production. Allowed: PtH class definition + mitigations table for $LAB_AD.
Command guide
Try these commands — PtH class (named, mitigation focus)
═══ WINDOWS / POWERSHELL (Defender Lab) ═══
Verify Credential Guard is active (prevents LSASS memory theft of NTLM hashes)
Command — copy this
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesConfigured, SecurityServicesRunning
Check Restricted Admin Mode status for RDP (mitigates Pass-the-Hash exposure)
Command — copy this
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -ErrorAction SilentlyContinue
═══ DEFENDER AUDITING ═══ Monitor Event ID 4624 (Logon Type 9 = NewCredentials, typical of PtH tools)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624} -MaxEvents 10 -ErrorAction SilentlyContinue | Where-Object {$_.Properties[8].Value -eq 9}Primary tools to practice this lesson: curl, python3. Reference sites: MITRE T1550.002 Pass the Hash (https://attack.mitre.org/techniques/T1550/002/); MITRE T1550.003 Pass the Ticket (https://attack.mitre.org/techniques/T1550/003/); Microsoft Credential Guard (https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. PtT class (named, mitigation focus)
Material: exported TGT/TGS from compromised session. Reuse: inject ticket into session — monitor 4769, unusual ticket lifetime extension, cross-host ticket use. Mitigations: short lifetimes, Protected Users (no unconstrained delegation cache), device compliance.
Lab literacy: name difference PtH (hash) vs PtT (ticket) — not export commands on neighbor laptops.
3. Defender stack (no dump guides)
Credential Guard + LSA protection, Protected Users for admins, LAPS for local admin, tiered admin workstations, disable NTLM where possible, monitor lateral auth patterns.
Ship: PtH/PtT comparison table — material, reuse, three mitigations each. Next: Auth Abuse Lab.
4. What you ship: PtH/PtT class card for $LAB_AD
PtH vs PtT table with mitigations. $LAB_AD named. NO credential dump cookbooks. chmod 600.
5. What you record before the next lesson
Date. PtH/PtT card. $LAB_AD named. File t25-m05-l03-pth-ptt-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
secretsdump on production DC. PtH tutorial on classmate laptop without permission.
Right
Write PtH/PtT class card with mitigations for YOUR $LAB_AD. Next: Auth Abuse Lab.
Mission: compare PtH and PtT classes
1) Define PtH and PtT in one line each. 2) List three mitigations per class. 3) Name one event ID to monitor. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Protected Users + tiered PAWs stack well against both classes.
Knowledge Check
APPLY: PtH/PtT literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Pass-the-Ticket reuses Kerberos ticket material.
True or False
Knowledge Check
APPLY: PtH mitigation includes:
Multiple choice