value:  GALLIUM used dumped hashes to authenticate to other machines via pass the hash. ;; HOPLIGHT has been observed loading several APIs associated with Pass the Hash. ;; Kimsuky has used pass the hash for authentication to remote access software used in C2. ;; Mimikatz's SEKURLSA::Pth module can impersonate a user with only a password hash to execute arbitrary commands. ;; Night Dragon used pass-the-hash tools to gain usernames and passwords. ;; Pass-The-Hash Toolkit can perform pass the hash. ;; PoshC2 has a number of modules that leverage pass the hash for lateral movement.
name: Use Alternate Authentication Material: Pass The Hash