Suspected identity theft (pass-the-ticket) on multiple endpoints false positive

Hi Anfo13 ,

It isn’t necessarily a mistake. In Sentinel, you can map the IP to the Host entity type (see here: Host entity schema)

Also depending on the detection rule logic and log sources, yada yada, seen instances where the IP gets mapped to a host entity type name just due to where the IP appeared in the log and the rule logic not accounting for it.

Nevertheless, I believe the source for this alert is Defender for Identity which monitors the event logs and attempts to resolve IPs internally and fallback to MDE DeviceNetworkInfo. If everything else checks out, it could be a DNS issue.

One question to ask, did victimA log onto hostA in the past to even allow attackerB to attempt a theft? If not, it could be a name resolution issue. Otherwise, go from there.

 Best,

Dylan