Skip to content

Pass the Hash

Subtechnique · ATTACK:enterprise:T1550.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1550.002",
  "title": "Pass the Hash",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1550/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e",
  "external_id": "T1550.002",
  "domain": "enterprise",
  "created": "2020-01-30T16:36:51.184Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Stealthbits Overpass-the-Hash",
      "url": "https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0743264d-1356-4f9e-96cc-8698f5e0e862

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c0cd7a2-496b-458d-b041-e05816450502

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5b5d67-44f6-4725-951e-ce614385c361

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S0122 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dc42b4c-4a93-4fc6-bad3-b5498ad500b1

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22ccfcb8-cb4a-4b9e-bc2d-c0bd2701e2e9

Microsoft SIR Vol 19

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--245c2bf3-f630-4850-8fef-9580f5672b02

Crowdstrike HuntReport 2022

ATTACK:enterprise:M1052 → mitigates → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dcd6644-f1d4-4001-81a5-95701fd29360

GitHub IAD Secure Host Baseline UAC Filtering

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34cb1bf0-c738-4637-84cc-c0472b105669

NCC Group Chimera January 2021

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b35fec9-ee0d-4c2d-9936-0aa06ad6a49a

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43fec1ed-cc26-4036-95c0-1598150f3916

Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4973496a-2a49-4428-b2db-0629a97df9d3

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64f33d8d-6060-40ab-8fbb-bd8b249702f7

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b83bc1e-edfc-4c6a-961f-d3757ae6a234

Adsecurity Mimikatz Guide · NCSC Joint Report Public Tools · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70894185-3b59-40ff-ab32-d594ecc4b1f7

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aa9c0cc-ce50-4975-9023-258a42270d22

Rostovcev APT41 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e5e2fd3-cab4-4853-81ad-9bf50e1390bd

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80e06d13-4c96-464c-9b9f-d0cb2b5fac18

CISA AA20-301A Kimsuky

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--872c6f1b-aa4f-4d43-b35d-c4216d2f4559

Github PowerShell Empire

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a86cd72-8386-4c75-8362-7b9020add12b

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a62e2165-9f7e-44ed-8523-7e3a805a94db

CISA GRU29155 2024

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b06103d8-d410-418e-851a-63ca820cc27e

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b33a7611-2426-434d-873a-6d74a8f91974

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be8c0014-e10e-4854-8a5b-8a06e35a8623

CME Github September 2018

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4cd588d-264a-468d-a472-8667b363d819

McAfee Night Dragon

ATTACK:enterprise:T1550.002 → subtechnique-of → ATTACK:enterprise:T1550

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c54ccdc7-ed15-45c7-bfc9-f6e6e2b0d7f3

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee4d1b24-603f-40df-8f21-3c053fba275f

Cybereason Soft Cell June 2019

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1078f12-fc10-42d8-9882-c8f521f3a37c

sentinelone operationDigitalEye Dec 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.