How to check if your Windows 11 is vulnerable to Pass-the-Hash attacks

¿How to check if your Windows 11 is vulnerable to "Pass-the-Hash" attacks? In recent years, concern about the Security in Windows 10 and Windows 11 It has skyrocketed, and with good reason. There are increasingly more attacks that don't need to "crack" your password, but rather exploit how the system itself manages your credentials. One of the most dangerous is the attack Pass-the-Hash (PtH)which has been reinforced by vulnerabilities such as CVE-2021-36934 (known as HiveNightmare or SeriousSAM) and by common misconfigurations in corporate networks.

If you use Windows 11 at home or at work, it's essential to know How to check if your computer is vulnerable to Pass-the-HashWhat vulnerabilities exist (SAM registration, NTLM, LSASS, BYOD, lateral movement, etc.) and what real protections Microsoft offers (Credential Guard, Device Guard, Windows Hello for Business, passkeys, health attestation, MDM, segmentation, etc.)? Below you'll find a comprehensive guide, explained in Spanish (Spain) and with practical examples, to help you understand the problem and maximize the security of your environment.

What is a Pass-the-Hash attack and why is it so dangerous?

An attack Pass-the-Hash It consists of an attacker stealing the hash of your password (usually an NTLM hash) and uses it directly to authenticate on other systems, without needing to know the plaintext key. The Windows system accepts this hash as proof of identity, so the adversary can log in and move around the network as if they were the legitimate user.

In practice, this means that There's no need to decrypt the passwordSimply capture the hash from the compromised machine (LSASS memory, SAM database, memory dumps, VSS shadow copies, etc.) and reuse it against other hosts. Well-known tools such as Mimikatz, Cobalt Strike, Invoke-TheHash, SharpKatz or wce They simplify this process to the extreme.

This approach fits perfectly with the tactic of Lateral movement in Active DirectoryOnce they have obtained hashes of local or domain accounts (especially administrators), the attackers move from machine to machine, escalate privileges, access sensitive data and, in many cases, end up deploying ransomware or stealing large volumes of information.

Why it affects Windows most of all (and how it compares to other systems)

Windows is especially attractive to these types of attacks because it has implemented mechanisms like the following for years: single sign-on (SSO) and stores NTLM hashes and cached credentials so it doesn't constantly ask the user for the password. This is very convenient, but it also means that These hashes are available in memory or on disk and can be overturned if the equipment is compromised.

In corporate environments, where Many computers share local administrator passwords (for example, RID-500 with the same key on all stations), things get even worse: it is enough to compromise one machine to reuse the same hash on dozens or hundreds of devices using Pass-the-Hash.

Other systems such as macOS They tend to use more biometric authentication (fingerprint, Face ID, hardware-protected key fobs) and rely less on reusing NTLM hashes. Linux and Unix can also suffer similar attacks, but in practice the volume and homogeneity of the Windows park This makes the real focus of PtH on this ecosystem.

How password hashes are generated and stored in Windows

When you create a user account in Windows, the system generates a NTLM hash your password and stores it in the local database SAM (Security Accounts Manager) or on the domain controller (in the case of domain accounts). This hash is reused across multiple sessions until you change your password.

Additionally, during login, the process LSASS (Local Security Authority Subsystem Service) It loads critical information into memory related to credentials, Kerberos tickets, and other secrets. If an attacker manages to execute code with elevated privileges, they can dump the LSASS memory and extract hashes, Kerberos tickets (Pass-the-Ticket) and, in some cases, even plaintext passwords.

All this means that if your Windows 11 doesn't apply the appropriate protections, anyone who achieves local code execution (for example, through malware or a privilege escalation exploit) has a very viable path to steal credentials and launch Pass-the-Hash attacks.

CVE-2021-36934 (HiveNightmare / SeriousSAM): Windows 10 and Windows 11 most exposed

One of the most talked-about vulnerabilities related to PtH is CVE-2021-36934, known as HiveNightmare or SeriousSAM. In certain versions of Windows 10 and Windows 11, the access control lists (ACLs) from the configuration files of %windir%\system32\config They were configured too permissively.

The problem is that users of the "Users" group (without administrator privileges) They could read, through shadow copies from the Volume Shadow Copy Service (VSS), the files containing the system's most sensitive databases: SAM, SYSTEM and SECURITYThis allows you to extract NTLM hashes from all accounts on the device, including administrator accounts, without needing to be a local admin.

An attacker who exploits this vulnerability can dump those databases, obtain the hashes, and use them in attacks Pass-the-Hash to escalate to local administrator or even move to other systems, depending on how the credentials are configured on the network.

Real impact of HiveNightmare on Pass-the-Hash attacks

With CVE-2021-36934, a user with local access to the computer (or malware running with standard user permissions) can Read Registry hives from a VSS snapshot using special routes such as \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyNFrom there, offline analysis tools can extract the SAM hashes and use them for cracking or PtH.

This scenario makes any affected Windows 10/11 endpoint in a kind of "open safe": even if the attacked account does not have elevated privileges, if team or domain administrators have logged in, their hashes are on the system and can be reused to completely compromise the environment.

Microsoft published the CVE, acknowledging that the flaw was due to overly broad ACLs and recommended mitigating restricting access to %windir%\system32\config and removing vulnerable VSS shadow copies. Official patches were later released, but for a time it remained a lucrative attack vector for ransomware operators and APT groups.

How to tell if your Windows 11 is vulnerable to Pass-the-Hash

There is no single "check" that tells you if your Windows 11 is immune, because Pass-the-Hash is a technique, not a single bug.However, you can evaluate different aspects that, combined, determine how exposed you are:

• Windows version and patch status (CVE-2021-36934 and other escalation vulnerabilities).
• NTLM configuration and authentication (if NTLM is widely used, uncontrolled SSO, etc.).
• Credential and hash management (LSASS accessible, SAM exposed, shadow copies unprotected).
• Use of advanced protections such as Credential Guard, Device Guard and virtualization-based security.
• Privilege model (if users are local admins, if passwords are reused between computers, etc.).

1. Check Windows version and relevant CVEs

To begin, on your Windows 11 (or 10) you can check the exact version running winver (Win + R > write) winverThe builds affected by CVE-2021-36934 correspond to Windows 10 from version 1809 onwards and certain builds of Windows 11.

If your build matches those documented by Microsoft for SeriousSAM and You have not installed the subsequent cumulative patchesIt's very likely that your system has been or still is vulnerable. It's advisable Review the Windows Update history and verify if the security updates associated with the CVE have been applied.

In addition, other vulnerabilities must be considered elevation of privileges which, although not directly linked to SAM, allow an attacker to obtain administrator privileges and, from there, dump LSASS or the local user database without much resistance.

2. Check if the SAM and SYSTEM ACLs are too permissive

The core of the problem in HiveNightmare was the overly permissive ACLs in the folder \Windows\System32\configTo check it manually, you can:

• Gonna C:\Windows\System32\config, right click > Properties > Security.
• Check if the group Users has read (RX) permissions on the files SAM, SYSTEM and SECURITY.

Although direct access to these files is usually protected, the big trick is that VSS snapshots inherit these ACLsTherefore, even if live access appears to be denied, a standard user can read the same files from an older shadow copy as long as they have read permissions on the original path.

To make matters even more complicated, many systems have enabled File history or System RestoreThis generates VSS snapshots without the administrator being fully aware of the extra surface area this opens up if the ACLs are incorrectly set.

3. Analyze the use of NTLM, SSO, and credential reuse

Another critical factor is how much you depend on NTLM and single sign-onIn older or poorly hardened networks, NTLM is overused and not restricted to truly necessary scenarios. This leaves the door open to Pass-the-Hash attacks and other abuses such as NTLM relays.

You should also be concerned about the reuse of local administrator passwordsIf the RID-500 (Integrated Administrator) account or any other privileged local account shares the same password across many computers, a single hash leak multiplies the potential impact of the attack by ten or one hundred.

Tools like the free solution Microsoft LAPS (Local Administrator Password Solution) They allow you to automatically generate and rotate a unique, random password for the local administrator of each machine, drastically reducing the effectiveness of local account-based PtH.

4. Check if Credential Guard and virtualization-based security are enabled

In Windows 10/11 Enterprise and compatible editions, Microsoft offers Credential Guard, one of the most powerful defenses against Pass-the-Hash. This feature relies on the Virtualization-based security (VBS) and in Hyper-V to isolate LSASS secrets in a protected container, inaccessible even to a compromised kernel.

When Credential Guard is enabled, domain hashes and other secrets are not stored directly in visible LSASS memory, but in an isolated process (lsaiso.exe) controlled by the hypervisor. This breaks many classic LSASS dump attacks and mitigates many traditional PtH scenarios.

To check if VBS and Credential Guard are active, you can use tools such as msinfo32 (reviewing the "Virtualization-based security features" section) or group policies in Administrative Templates > System > Device Guard and options for "Virtualization-based Security" and "Credential Guard".

In corporate environments, using Credential Guard also involves checking hardware requirements: TPM 2.0, secure boot, UEFI and virtualization support are key components for VBS to function correctly.

How the Pass-the-Hash attack works step by step

In a typical Windows environment, a Pass-the-Hash attack unfolds in several phases that threat groups have highly automated:

1. Initial access: exploitation of a vulnerability, phishing, execution of malware, theft of credentials, etc.
2. Escalation of privileges (if necessary): taking advantage of elevation failures or configuration errors to gain access to local administrator or SYSTEM.
3. Hash dump: Extraction of NTLM hashes from SAM, LSASS or VSS shadow copies using tools such as Mimikatz, Cobalt Strike, pth-tools or PowerShell scripts.
4. Remote authentication: use of stolen hashes to authenticate against other computers via SMB, RDP, WMI, WinRM or other protocols, mimicking legitimate logins.
5. Lateral movement and persistence: creation of new accounts, distribution of malware, use of scheduled tasks, services or backdoors to maintain access.

A classic example described by multiple studies shows how, starting from the local administrator account RID-500 Using the same password on multiple computers, a hashdump With Cobalt Strike or Mimikatz, the NT hash is copied and then a command is launched pth or is used Invoke-TheHash to execute remote actions on other computers with that same hash.

Even more advanced is the use of steal_token or similar techniques to spoof SYSTEM process security tokens, control remote services via sc.exe, wmic o schtasksand deploy ransomware or remote administration tools across the entire network with very little friction.

Why Pass-the-Hash attacks are so effective in the real world

The effectiveness of Pass-the-Hash is not theoretical: numerous APT groups and ransomware gangs They use it routinely. MITRE ATT&CK documents its use by actors such as APT41, APT29, FIN13, APT31, and others, who combine PtH with Pass-the-Ticket, Kerberoasting, and NTLM abuse to move laterally in complex networks.

Recent investigations show campaigns where operators of MedusaLocker (BabyLockerKZ), APT29 or BRONZE VINEWOOD They integrate scripts into their toolkits such as Invoke-TheHashC# versions such as Sharp-SMBExec, and classic utilities such as PsExec and Mimikatz to industrialize the use of NTLM hashes and stolen Kerberos tickets.

In parallel, the trend towards attacks Living Off the Land (LOTL) Detection is complicated: it involves the misuse of PowerShell, WMI, native Windows tools, and legitimate credentials, without requiring highly visible malware. In many environments, this passes as normal traffic for weeks or months until the attacker launches their final phase (for example, encrypting data or exfiltrating massive amounts of information).

Key protection measures against Pass-the-Hash in Windows 11

To minimize the probability and impact of a Pass-the-Hash attack on Windows 11 (and Windows 10), it is necessary to combine several layers of protection, both at the system level and in terms of security. individual equipment like network architecture and identitySome of the most relevant ones are:

1. Activate Credential Guard and virtualization-based security

As we have discussed, Credential Guard It uses Hyper-V and VBS to isolate corporate credentials and sensitive hashes, preventing malware from directly reading those secrets from LSASS. To enable it, you can:

• In corporate environments, use Group directive en Device Configuration > Administrative Templates > System > Device Guard and enable "Virtualization-based Security" and "Credential Guard".
• Make sure your hardware supports UEFI, secure boot, TPM 2.0 and virtualization (Intel VT-x/AMD-V with SLAT).

Once activated, Credential Guard breaks a large part of the classic PtH vectorsThis is because hashes and tickets are no longer stored where traditional dumping tools expect. This defense is especially important on administrative workstations, critical servers, and teams that access high-value resources.

2. Use Windows Hello for Business and passkeys (passwordless authentication)

An even more robust approach is to stop relying so much on passwords. Windows Hello for Business (WHfB) and the FIDO2-based passkeys They change the model completely: instead of reusable NTLM hashes, they use public/private key cryptography linked to the device and the user.

In this model, the The private key never leaves the secure device. (TPM, hardware enclave), and the public key resides on the authentication server (for example, Microsoft Entra ID, formerly Azure AD). If an attacker steals what used to be the "hash," they don't actually need to pass anything on to another system, because There is no NTLM hash that can be reused.

In Windows 11 you can configure WHfB and passkeys in Settings > Accounts > Sign-in options, wearing facial recognition, fingerprint, or robust PINIn enterprise environments, implementation is orchestrated with Intune or group policies, using models such as "cloud trust" or "hybrid certificate trust" to integrate with Microsoft Entra ID and achieve SSO without relying on NTLM.

3. Reduce privileges and manage administrator accounts properly.

Another basic pillar is to apply a model of minimal privilegeUsers in standard departments (HR, finance, marketing, etc.) should not be local administrators of their teams. Every account with local admin privileges is another opportunity for PtH to succeed.

In addition, the passwords of RID-500 integrated manager must be unique and random in each teamAs already mentioned, LAPS or commercial privileged account management (PAM) solutions can automate this rotation, preventing the same local hash from granting access to multiple workstations.

It is also important structuring the administrative levelsClearly separate level 0 accounts (domain controllers, critical infrastructure), level 1 accounts (application servers), and level 2 accounts (workstations), and tightly limit where the most privileged accounts can log in from to minimize their memory exposure.

4. Update Windows and manage VSS shadow copies

Keeping your system up to date is not empty advice: many PtH and privilege escalation attacks rely on it vulnerabilities patched a long time agoMake sure that Windows Update regularly applies security bulletins, especially those related to LSASS, SAM, NTLM, and authentication protocols.

In the specific case of HiveNightmare, Microsoft recommended restrict the ACLs of %windir%\system32\config y delete shadow copies which already included lax permissions. Commands like vssadmin list shadows y vssadmin delete shadows They help to inventory and clean snapshots, always taking care not to delete critical backups.

Returning to the previous point, remember that VSS copies can allow you to read vulnerable hives. offlineTherefore, simply monitoring hot accesses to SAM or SYSTEM may not be enough to detect exploitation of this channel.

5. Strengthen secure boot, TPM, and hardware-based defenses

Windows 11 takes great advantage of low-level technologies such as UEFI Secure Boot, TPM 2.0, Early Launch AntiMalware (ELAM), Device Guard and hypervisor-based code integrity (HVCI)All of this helps prevent the loading of rootkits, bootkits, or malicious drivers that could alter the boot process and conceal the theft of credentials.

El TPM It plays a key role in status verification and key protection (BitLocker, Windows Hello, certificates, etc.). Boot measurements are stored in PCR (Platform Configuration Registers) and can be sent to Microsoft remote status attestation service so that MDM solutions (like Intune) can verify if the device is in good condition before allowing it to access sensitive resources.

Combining BitLocker Secure Boot and TPM make it difficult for someone with physical access (for example, an attacker who steals the laptop) to boot from USBMount the disk and extract NTLM hashes or SAM hives without authenticating.

Pass-the-Hash attack detection and lateral movement

Even with all protections in place, it's wise to assume that an attacker might still manage to get in. That's why you need good detection and response capabilities on your endpoints and your network.

The solutions of EDR (Endpoint Detection & Response) Tools like Microsoft Defender for Endpoint (MDE) are capable of detecting credential dump attempts, Mimikatz execution, LSASS abuse, suspicious use of PsExec, WMI, PowerShell, and Pass-the-Hash and Pass-the-Ticket patterns. These tools often offer threat hunting features to enable SOC analysts to look for anomalous behavior.

In Windows, key events such as 4624 (successful login), 4625 (failed), 4648 (use of explicit credentials) and 4769 (Kerberos ticket request) They allow the identification of lateral movement patterns if properly correlated within a SIEM. Similarly, Sysmon provides significant additional visibility into process creation, access to sensitive files, and network connections.

Specific monitoring rules for HiveNightmare and SAM

After discovering CVE-2021-36934, many security vendors published rules to detect attempts to exploit the SAM and SYSTEM exposure. For example:

• Alert about executions of reg.exe that they access HKLM\\system, HKLM\\security o HKLM\\sam from non-administrator users.
• Monitor PowerShell commands that include paths to \\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\System32\config\(sam|system|security).
• Enable SACL in the SAM, SYSTEM and SECURITY files to record 4663 read events by any user, and correlate them with accesses from VSS.

These detections, combined with others for WMI, Mimikatz, scheduled tasks, and lateral movement activities, greatly increase the chances of detecting a Pass-the-Hash attack before it consolidates and causes a disaster.

BYOD, MDM and conditional access control environments

In scenarios of Bring Your Own Device (BYOD) And with mobility, the problem is compounded because more and more users are accessing corporate resources from personal or poorly managed devices. This is where solutions from MDM (Mobile Device Management) like Microsoft Intune and the concept of conditional access Microsoft Login ID.

Windows integrates an MDM client that allows these solutions to apply security policies, collect inventory information, enforce encryption, require minimum operating system versions, and, very importantly, use the state attestation to verify that the device boots in a reliable state (with secure boot, BitLocker active, Device Guard configured, etc.).

Conditional access control can combine user identity, the device compliance status and other factors (location, application type) to decide whether to grant access to resources such as Office 365, SaaS applications, or local applications published via application proxy or ADFS. This means that a device potentially vulnerable to PtH may be blocked or receive very limited access until it complies with corporate policies.

Cloud, advanced lateral movement, and future trends

Lateral movement and credential attacks are no longer limited to on-premises environments. On platforms cloud and containers (Kubernetes, Docker, serverless)Attackers leverage service accounts, IAM roles, service principals, and tokens to move between services and accounts, sometimes more easily than on traditional networks.

In AWS, for example, an IAM role attached to a compromised EC2 instance can allow an attacker to... assume other roles and move laterally across accounts and services. In Azure, the commitment of a main service With broad permissions, you can open the door to critical resources distributed across multiple subscriptions.

In the container world, container escapes (T1611), Kubernetes service account token abuse, and malicious image attacks in public repositories illustrate how the "secret stealing and reusing" logic behind Pass-the-Hash has moved to other layers of the infrastructure.

Ultimately, protecting Windows 11 against Pass-the-Hash attacks involves assuming that attackers are targeting your credentials and hashes as your most valuable asset, and by consistently deploying all available defenses: from patches and good ACLs in SAM and VSS, to Credential Guard, Windows Hello for Business, LAPS, network segmentation, EDR and conditional access; the more you reduce the exposure of your hashes and the ability to move laterally with them, the fewer options an adversary will have to turn a simple compromised machine into a massive incident.