ATT&CK technique
View on MITRE ATT&CK →
T1550.002
Pass the Hash
Lateral Movement
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Pass-the-Hash (PtH) Attempt | production | 2026-09-18 |
| elastic | Potential Kerberos Attack via Bifrost | production | 2026-09-18 |
| elastic | Potential Invoke-Mimikatz PowerShell Script | production | 2026-09-18 |
| elastic | Potential PowerShell Pass-the-Hash/Relay Script | production | 2026-09-18 |
| elastic | Local Account TokenFilter Policy Disabled | production | 2026-09-18 |
| sigma | NTLM Logon | test | 2024-07-22 |
| sigma | NTLMv1 Logon Between Client and Server | test | 2023-06-06 |
| sigma | Hacktool Ruler | test | 2022-10-09 |
| sigma | Pass the Hash Activity 2 | stable | 2022-10-05 |
| sigma | Successful Overpass the Hash Attempt | test | 2021-11-27 |