An Open Source Approach to Detect Pass the Hash Attack in Active Directory Using Wazuh and Sysmon

Jul 3, 2026

Upload by Anda

Pass-the-Hash (PtH) attacks pose a persistent threat to organizations using Microsoft Active Directory by enabling privilege escalation, lateral movement, and long-term access without plaintext credentials. PtH can also bypass multifactor authentication, which makes it attractive for advanced persistent threat groups and ransomware operators. This paper introduces an open-source detection and mitigation system that analyzes PtH stages such as hash extraction, unauthorized NTLM authentication, and subsequent host compromise, using Sysmon telemetry and Wazuh log analysis to support timely detection in mid-sized environments.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages30

Reading Time1 h 16 min

Introduction

Active Directory fundamentals and threat relevance

Pass-the-Hash attack mechanism and typical stages

Detection approach using Sysmon and Wazuh

ISSN 0361-7688, Programming and Computer Software, 2025, Vol. 51, No. 8, pp. 645–674. © Pleiades Publishing, Ltd., 2025. An Open-Source Approach to Detect Pass-the-Hash Attack in Active Directory Using Wazuh and Sysmon Jacques Gerald Vivian Felicitea,*, A. Omar Portillo-Dominguezb,c,** (ORCID: 0000-0003-3009-985X), and Vanessa Ayala-Riveraa,c,*** (ORCID: 0000-0001-7449-6473) a School of Informatics and Cybersecurity, Technological University Dublin, Dublin, Ireland b School of Enterprise Computing and Digital Transformation, Technological University Dublin, Dublin, Ireland c Digital Futures Research Hub, Technological University Dublin, Dublin, Ireland *[e-mail: b00158349@mytudublin.ie](e-mail: b00158349@mytudublin.ie) **[e-mail: vanessa.ayalarivera@tudublin.ie](e-mail: vanessa.ayalarivera@tudublin.ie) ***[e-mail: omar.portillo@tudublin.ie](e-mail: omar.portillo@tudublin.ie) Received August 17, 2025; revised August 27, 2025; accepted August 27, 2025 AbstractPass-the-Hash (PtH) attacks remain a significant security threat to organizations worldwide, particularly those relying on Microsoft Active Directory. This attack allows adversaries to to escalate privileges, move laterally across networks, and maintain persistent access without obtaining plaintext credentials. ditionally, PtH attacks can bypass multifactor authentication (MFA), making them a preferred technique for advanced persistent threat (APT) groups and ransomware operators. While previous research and vendor solutions have proposed PtH mitigation strategies, many rely on proprietary software, lack transparency, or fall short in detecting real-time attacker behavior in mid-sized environments. To tackle this problem, this paper presents an open-source-based detection system aimed at identifying and mitigating PtH attacks, offering a cost-effective alternative to commercial solutions. We systematically analyze the PtH attack vector, which exploits weaknesses in the Windows New Technology LAN Manager (NTLM) authentication protocol. Our study discusses the core stages ofa PtH attack, including hash extraction through credential dumping, unauthorized authentication using stolen NTLM hashes, and subsequent lateral movement to compromise additional hosts. We emphasize the stealthy nature of these attacks and their ability to evade conventional security tools; thus, the importance of having a multilayered defense strategy. Through a lab-based experimental setup, we demonstrate how combining Sysmon for telemetry and Wazuh for log analysis enables timely and effective detection of PtH behaviors. Our findings validate that open-source tools can significantly enhance an organization’s ability to detect and respond to PtH activity. Our work also offers practical insightsand actionable implementation guidance for security practitioners seeking to secure Active Directory environments using accessible, community-driven technologies. Keyword: application security, active directory security, pass-the-hash attack, open-source software DOI: 10.1134/S0361768825700483 1. INTRODUCTION In today скs enterprise IT landscape, Microsoft Active Directory (AD) is a foundational service for managing digital identities and access to networked resources. Today, over 95% of Fortune 1000 companies have adopted AD, deploying it within their infrastructure [1], and approximately 50000 organizations currently rely on it for directory services [2] . AD enables centralized administration of users, computers, groups, and policies across complex networks, extending its capabilities into cloud-based technologies through Azure AD integration [3] . Often compared to a hierarchical phone book for Windows systems, AD organizes directory information through components such as domains, organiza- tional units (OUs), forests, and trees. It relies on domain controllers (DCs), which authenticate users and enforce security policies. DCs maintain a writable copy ofthe AD database and verify cre

FAQs

What makes pass-the-hash (PtH) attacks especially dangerous in Active Directory environments?

PtH enables adversaries to escalate privileges, move laterally, and maintain persistent access without plaintext credentials. It can also bypass multifactor authentication, which increases impact for sophisticated attackers.

How does the proposed open-source approach detect PtH activity?

The system correlates Sysmon telemetry with Wazuh log analysis to identify behaviors across PtH stages, including hash extraction and unauthorized NTLM authentication followed by lateral movement.

Which parts of the PtH attack lifecycle are emphasized in the paper?

The paper highlights credential dumping and hash extraction, authentication using stolen NTLM hashes, and later lateral movement to compromise additional hosts, focusing on stealth and evasion of conventional tools.

Jul 3, 2026

Upload by Anda