MITRE ATT&CK T1550.002: Pass the Hash (Enterprise Tactic TA0005 - Defense Evasion / TA0008 - Lateral Movement)

What MITRE ATT&CK T1550.002: Pass the Hash (Enterprise Tactic TA0005 - Defense Evasion / TA0008 - Lateral Movement) requires

MITRE ATT&CK T1550.002 (Pass the Hash) is an Enterprise Defense Evasion and Lateral Movement sub-technique of T1550 (Use Alternate Authentication Material). Adversaries may "pass the hash" using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. Affected platforms: Windows. MITRE-documented mitigations include M1051 Update Software, M1052 User Account Control, M1018 User Account Management, M1026 Privileged Account Management. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, CM-05, CM-06, IA-02, SI-02.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1550/002/

SHA-256 integrity: c8b4a1bd9cd3f4c4f62a0e4ab31d1531e67524b92facd3cca0c6c772fa57f1eb

Primary Citations — 7 traced to source

• MITRE ATT&CK Technique T1550.002: Pass the Hash (https://attack.mitre.org/techniques/T1550/002/)
• MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-t1550-002-pass-the-hash.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-t1550-002-pass-the-hash.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-t1550-002-pass-the-hash
• Back to registry: Browse all 10,085 compliance nodes