Forum Discussion

Pd_Redcar's avatar
Pd_Redcar
Copper Contributor
Sep 20, 2023

MS Defender Suspected identity theft (pass-the-ticket) alerts

Hi We've been receiving a number of alerts as above. We think this may be related to our AOVPN solution reassigning identical IP addresses to users and Defender deciding these are pass the ticket accounts has anyone else seen something similar? Is this 'normal' behaviour from Defender?

2 Replies

  • logger2115's avatar
    logger2115
    Brass Contributor
    Sep 30, 2024
    AOVPN here and MDI in recommended test mode. See several of these due to DA AOVPN. How did you go about suppressing these alerts? We are aware exhibited behavior is expected but any thoughts on exclusions for detection rule id? Raised case with support and response were unsatisfactory as it can directly introduced slippage on alerts.
  • robert_welsofd's avatar
    robert_welsofd
    Copper Contributor
    Sep 20, 2023

    Pd_Redcar We started to see these alerts yesterday as well.  We are also using AoVPN and think that it may be an issue with re-assigning IPs.  If you find anything out please let post a message here.  I will do the same