Forum Discussion
Correlation issue for Identity theft using Pass-the-Ticket attack and roaming users
Hi Justin,
This is right in case of PTT.
In some cases, where the IP addresses are changing rapidly, Azure ATP might not be able to determine if different IP addresses are used by the same computer, or by different computers.
This is a common issue with undersized DHCP pools(VPN, WiFi, etc.). DHCP pools with short lease times or shared IP addresses (NAT devices). you can find it in our suspicious activity guide: https://aka.ms/atasaguide-ptt
Thanks,
Tali
Hi Justin,
This is right in case of PTT.
In some cases, where the IP addresses are changing rapidly, Azure ATP might not be able to determine if different IP addresses are used by the same computer, or by different computers.
This is a common issue with undersized DHCP pools(VPN, WiFi, etc.). DHCP pools with short lease times or shared IP addresses (NAT devices). you can find it in our suspicious activity guide: https://aka.ms/atasaguide-ptt
Thanks,
Tali
- Hello Tali Ash. We too have seen an up tick in these alerts. It looks to me that it does revolves around DNS trying assign an IP address to two different devices or one device has the IP but DNS is trying to assign to a second device. Well keep watching this post for any updates.
Is there any tuning options in DofI to tune these out?
