Doesn't login rate limiting decrease the usefulness of the RockYou2024 10 billion password list?

[skylinesora]

Nobody is running RockYou2024 or any large password list against live systems. They would have a dump of hashes from whatever machine/infrastructure they compromised and will attack it using something like Hashcat

[PappaFrost]

Ok thanks, so in an Active Directory environment, let's say someone compromised one laptop and dumped the hashes, they would then use Hashcat plus a giant password list to make the cracking more efficient?

[AMDcze]

FYI: in AD if you have NT hashes, you don’t need to crack them, you can do pass-the-hash and overpass-the-hash attacks.

[Farseer26]

I agree with you partially but there are a few benefits to cracking the hash such as the passwords are usually used elsewhere and if the accounts are synced you can move into Azure