Understanding throughly PTH alert: on what is it triggering?

Hi Tali,

Thanks for your response. I was already afraid you couldn't share the logic. Maybe it is possible to share with specific partners. Tuning a detection capability without knowing the internal logics is rather difficult. I believe Citrix is using passthrough authentication and that might trigger the alert. Strangely in the environment I am talking about, this is not always triggering. We cannot simulate it. Any further details or detailed guidance (maybe offline) would be highly appreciated.

Kind regards,
Keith

Thanks for mentioning "known issues with Citrix and pass-the-hash alerts." That aligns with our false positive.

But come on, when I hear a vendor say "we can't expose the logic used to create this alert," as an analyst, I think "I don't want to use that tool." I just wasted 3 days looking into a system and the related domain controller looking for anomalous or suspicious evidence because 1) the alert didn't contain NEARLY enough information for me to make an educated decision (like what commands were used, how did the system determine this was worthy of an alert, if and what binaries were involved), and 2) researching the alert online didn't give me any additional useful information.

Vendor responses like this make me want to disable any of those alerts and create my own. At least I understand how my custom alerts are triggered and I can tune them.

</disappointment>