Identity theft using Pass-the-Hash attack verify false positive

Hello,   I have some messages about "Identity theft using Pass-the-Hash attack" in our ATA. Checked also some things on the client but cannot find some suspicious activities. I opened a MS ticket s...