Reducing the Effectiveness of Pass-the-Hash

[Nytro]

Reducing the Effectiveness of Pass-the-Hash

National Security Agency/Central Security Service

Information Assurance Directorate

Contents
1 Introduction .......................................................................................................................................... 1
2 Background ........................................................................................................................................... 1
3 Mitigations ............................................................................................................................................ 2
3.1 Creating unique local account passwords .................................................................................... 3
3.2 Denying local accounts from network logons ............................................................................... 4
3.3 Restricting lateral movement on the network with firewall rules ................................................ 5
4 Windows 8.1 Features .......................................................................................................................... 5
4.1 Deny local accounts from network logons in Windows 8.1 .......................................................... 5
4.2 New Remote Desktop feature in Windows 8.1 ............................................................................ 5
4.3 Protecting LSASS ........................................................................................................................... 6
4.4 Clearing credentials....................................................................................................................... 6
4.5 Protected Users group .................................................................................................................. 6
5 Conclusion ............................................................................................................................................. 7
6 References ............................................................................................................................................ 7
Appendix A: Creating unique local passwords .............................................................................................. 7
Appendix B: Denying local administrators network access .......................................................................... 8
Appendix C: Configuring Windows Firewall rules ......................................................................................... 9
Appendix D: Looking for possible PtH activity by examining Windows Event Logs ................................... 12
Appendix E: Summary of Local Accounts .................................................................................................... 12
Appendix F: Windows smartcard credentials ............................................................................................. 12

Download: https://www.nsa.gov/ia/_files/app/Reducing_the_Effectiveness_of_Pass-the-Hash.pdf