Pass the Hash with Ruler

This post announces a Troopers17 talk and details new Ruler capabilities to perform NTLM pass-the-hash against Exchange via HTTP-NTLM, explaining NTLMv1/v2 fundamentals and how operators can authenticate using captured NTLM hashes (e.g., from Mimikatz). It shows how to use Ruler flags like --hash and --admin to pivot through Exchange and create malicious Outlook rules, enabling mailbox takeover and post-exploitation actions across an organization.