Lateral Movement

Pass-the-Hash and Pass-the-Ticket attacks let adversaries move through Active Directory without ever cracking a password. This post walks through real Mimikatz and Impacket output, explains what it means, and shows exactly what defenders should do first.