Forensic Artifacts From a Pass the Hash Attack

Presented at DEF CON 23 (2015), Aug. 6, 2015, 3 p.m. (60 minutes).

A pass the hash (PtH) attack is one of the most devastating attacks to execute on the systems in a Windows domain. Many system admins are unaware about this type of attack and the amount of damage it can do. This presentation is for the system admins that don't have a full time forensics person working with them. This presentation will help identify key windows events and explain why these events are important. The presentation will also show various free tools that can assist in examining some of the common evidence left behind. The presentation will explain and demonstrate a pass the hash attack against common windows systems in an example domain. In the end, the presentation may offer some insight into what an attacker wants and needs to use PtH to pivot in a network.

Presenters:

• Gerard Laygui - Security Researcher
  Gerard has been in the IT industry for almost 20 years. He has held various network admin, system admin, web admin and security related positions throughout his career. He currently works for a Fortune 50 company doing compromise forensics and malware reverse engineering.

Links:

• https://defcon.org/html/defcon-23/dc-23-speakers.html#Laygui
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Video and Slides.mp4 (Video and Slides)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Video and Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Gerard Laygui - Forensic Artifacts From a Pass the Hash Attack - Video.srt (subtitles)
• https://www.youtube.com/watch?v=m6W9LlMvNfI

Similar Presentations:

• Black Hat USA 2015 / Defeating Pass-the-Hash: Separation of Powers
• Black Hat USA 2013 / Pass the Hash and Other Credential Theft and Reuse: Mitigating the risk of Lateral Movement and Privilege Escalation
• DerbyCon 3.0 All in the Family (2013) / Pass-The-Hash 2: The Admin’s Revenge