What is pass-the-hash?
Pass-the-hash is an attacker using the stored hash of a password, taken from a compromised computer's memory or disk, to authenticate as that user without ever knowing the password itself. It works with the older NTLM authentication still common in many networks and lets an attacker move from machine to machine with an administrator's identity. Defences include not logging in with domain administrator accounts on ordinary workstations, a unique local administrator password on each machine, protections that stop credentials being read from memory, restricting or disabling NTLM where possible, and endpoint protection. The hash theft happens on a host; the reuse appears on the network as administrative connections between machines that do not normally talk. NetSenX flags that lateral movement on every plan; it does not inspect the authentication protocol itself.