Let's talk mitigation for past the hash pass the password.
Now mitigating this completely is difficult.
But as an administrator you can make my life very difficult as an attacker.
So one thing to note is if you limit your account reuse for example Frank Castle being a local advocate
on multiple computers when we pass the password that got us into multiple machines we only had access
to one machine.
Now we laterally moved across the network to another machine.
And who knows what we're going to find because it's a whole different set of cash dump when you saw
we dumped the hash.
We can also start looking through files on computers looking for anything interesting.
You're going to see some more attacks that we're going to find here and there's different attacks that
we can pull off as a user so there's things that one machine might not have for us.
But once we move laterally to another machine then guess what.
It's a whole new ballgame.
And then that might open up something we didn't see before that allows us to escalate into domain admin.
So if we do not have local admins on machines or reusing them then guess what.
It's gonna be really hard for us to do that.
Again you should also limit who is that local administrator right least privilege we've talked about
this time and time again here the strong passwords come into play as well not so much for the passing
of the hash but passing of the password if we're never able to crack the entail and b to hash in the
first place and get in a shell on these machines then we're never gonna be able to actually perform
these attacks and get here in the first place.
So utilizing strong passwords in your network is big big big.
Lastly we talked about the last video privileged access management you can make my life very difficult
in a situation where you're using privilege access management in that story that I talked about where
I took down that network that had that million dollar privilege access management right they were using
cyber Iraq and they had that tool.
I took them down because they were using bad local ad and passwords and they were reusing them had they'd
been using good local app and passwords and they weren't reusing them.
I would have failed on that assessment.
Hands down no doubt about it.
But because of that they had a big weakness there and it can just bypass these million dollar systems.
However these systems are important very very important.
So if you can utilize it if you have the funds to utilize privacy issues management in your system and
your environment please do it.
It's really worth it.
So that's it for this.
So now we're going to move on to what are called toque impersonation attacks and these are really fun.
We're going to see why in the next video.