Forum Discussion

John Louden's avatar
John Louden
Copper Contributor
Aug 07, 2018

Generating alerts

Hi all,   We've starting rolling out EMS5 to our users, and have deployed the ATP Sensor on our dc's. The daily reports are working as expected but we have yet to see an alert. I've tried the FAQ t...
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Aug 08, 2018

What happened? did it alert on Pass The Ticket claiming the ticket was stolen from your source computer to the remote host?

Joe Stern's avatar
Joe Stern
Iron Contributor
Aug 08, 2018
Yes, that's exactly what happened. I decided to stop using mstsc with /remoteguard rather than generate false positives, or disable meaningful alerts.
  • EliOfek's avatar
    EliOfek
    Icon for Microsoft rankMicrosoft
    Aug 08, 2018

    Thanks for letting me know, we will check if we can spot that as false positive...

    (although technically you might say it's a benign true)