How to your organization mitigate the risk of a Pass-the-Hash (PtH) attack?

This mitigation strategies that you can use in your organization to help prevent both lateral movement and privilege escalation by decreasing the impact of credential theft.

Lateral Movement: In this activity, the attacker uses the credentials obtained from a compromised computer to gain access to another computer of the same value to the organization.

Privilege Escalation: In this activity, the attacker uses the credentials obtained from a compromised computer to gain access to another computer of a higher value to the organization.

These mitigations are effective, practical, and broadly applicable to different domain configurations.

These mitigations are defense-in-depth measures designed to ensure that your environment is protected even if these measures fail.

Mitigation	Effectiveness	Effort Required	Privilege Escalation	Lateral Movement
Restrict and protect local accounts with Administrative Privileges	Excellent	Medium	√	–
Restrict and protect local accounts with Administrative Privileges	Excellent	Low	–	√
Restrict inbound traffic using the Windows Firewall	Excellent	Medium	–	√
More Recommendations	Effectiveness	Effort Required	Privilege Escalation	Lateral Movement
Remove standard users from the local Administrators Group	Excellent	High	√	–
Limit the number and use of privileged Domain Accounts	Good	Medium	√	–
Configure outbound proxies to deny internet to Privileged Accounts	Good	Low	√	–
Ensure Administrative Accounts don’t have email accounts	Good	Low	√	–
Use remote management tools that don’t place reusable credentials on a remote computers memory	Good	Medium	√	–
Avoid logons to less secure computers that are potentially compromised	Good	Low	√	√
Update applications and operating systems	Partial	Medium	–	–
Secure and manage Domain Controllers	Partial	Medium	–	–
Remove LM hashes	Partial	Low	–	–
Other Mitigation	Effectiveness	Effort Required	Privilege Escalation	Lateral Movement
Disable the NTLM Protocol	Minimal	High	–	–
Smart cards and multifactor authentication (MFA)	Minimal	High	–	–
Jump servers	Minimal	High	√	–
Rebooting workstations and servers	Minimal	Low	–	–

Have a nice day!