Credential Access Tactic

Pass-the-Hash

Attacker steals NTLM password hashes and uses the hash directly to authenticate to systems or services without knowing the cleartext password, enabling rapid privilege escalation and lateral movement across Windows hosts

NTLM Relay

Attacker intercepts a victim’s NTLM authentication attempt and relays it to another service to gain unauthorized access, abusing the lack of strong mutual authentication in NTLM

Offline NTLM Hash Cracking

Attacker dumps NTLM hashes and uses tools (e.g., GPU-based crackers) to brute-force or dictionary-attack them offline, eventually recovering cleartext passwords

LM Hash Weakness (7-character split)

Legacy LAN Manager hashing converts passwords to uppercase, pads them to 14 characters, then splits them into two 7-character chunks and hashes each separately, making each half independently crackable and drastically weakening password security

Kerberoasting

Attacker requests Kerberos service tickets (TGS) for service accounts, then performs offline cracking against the ticket because it’s encrypted with the service account’s password hash, aiming to recover high-privilege service account credentials

AS-REP Roasting

Attacker targets accounts that do not require Kerberos pre-authentication, requesting AS-REP messages that can be brute-forced offline to recover the user’s password

Pass-the-Ticket

Attacker steals valid Kerberos tickets (such as TGTs or TGSs) from memory and reuses them to access services as a legitimate user, without needing the underlying password

Golden Ticket

Attacker forges a Kerberos Ticket Granting Ticket using the KRBTGT account’s hash, allowing them to impersonate any user in the domain and gain near-total control of AD resources

Silver Ticket

Attacker forges a Kerberos service ticket using a specific service account’s key, letting them impersonate users to that single service and gain unauthorized access to that application or service

LSASS (Local Security Authority Subsystem Service)

Core Windows process (lsass.exe) that enforces local security policy, handles logon authentication, and stores credential material (hashes, tickets, tokens) in memory, making it a prime target for credential dumpin