Pass-the-Hash

Once you have credentials or a shell on one host, the real game begins: moving through the network without getting caught. Lateral movement in Active Directory is where most engagements are won or lost. This is the full playbook. Every technique. The tools, the commands, the detection notes, and the OPSEC considerations that separate a successful engagement from a blocked one. What Is Lateral Movement in AD? Lateral movement is the process of using access on one system to gain access to others. In an Active Directory environment, this is especially powerful because credentials, tickets, and tokens are often reusable across the domain. ...

Active Directory credential attacks come in two flavors that confuse people constantly: Pass-the-Hash (PtH) and Pass-the-Ticket (PtT). Both let you authenticate as another user without knowing their plaintext password. But they work on completely different protocols, hit different defenses, and fail in different ways. This guide covers how each attack actually works under the hood, when to reach for one vs the other, how defenders detect them, and how red teamers stay ahead of detection. ...