Investigation priority score increase (Preview) alert

[Christo De Lange]

Hi 

Today we started receiving the above alert in CAS. Appreciate its preview but the contents of the alert made me sit up !  

Description: "ACCOUNTNAME" investigation priority score has increased from 0 to 208 in 13 hours, higher than 99% of other scored users. 

Each event that formed part of this alert gave a +8 score on the following action :

Resource access: Device DEVICENAME, property Spns cifs/DEVICENAME.Domain.com

SourcePort: Various

DestinationPort: 88

The account in question being the ATP service account, and the activity on 61 different devices, the source being a DC.. 

Has anyone else seen this? It looks dodgy as hell this suddenly being logged and not knowing what the activity means. Is this this expected activity for ATP service? 

Thanks in advance for your response!

[#2]

any updates? I would be curious what you concluded here. Probably warrants a support case if you are still stuck.

[#3]

are there any updates, we have this with a customer of ours?
We cannot understand what is happening in the background.
Does anyone have an explanation for this?

[#4]

Did you find a resolution for your situation?