AD Connect MSOL_ User + Suspected DCSync Attack

[Brian_Sutton]

We use AD Connect in order to replicate our on premise AD accounts to Azure AD.  The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account.  The AD Connect application is installed on a member server (i.e. not on a DC).  AATP is reporting "Suspected DCSync attack (replication of directory services)" for the MSOL_ user account running on that member server.  This appears to be a false positive.  Is this a known issue/false positive?

[#2]

@Brian_Sutton  Yes it is, you should exclude the account or the machine from this alert for now.

(Until we will have some news on this, we are working on a feature around this case, but it will take time to see results ...)

[#3]

@EliOfek How do I exclude this account/machine from this alert?  I only see an option to Close the alert or to Suppress it (resumes after 7 days).  Thanks!

[#4]

@Brian_Sutton Go to the configuration section , into the exclusions tab.

[#5]

@EliOfek How do we do this in MCAS as all ATP exclusions are now greyed out?!

The DCSync pre-configured policy doesn't seem to have an exclusion option. How should the AADConnect server be tagged to be excluded from the default Suspected DCSync attack (replication of directory services) policy ?

[#6]

@kristofvm 

Hi,

From your message I am not sure whether it's not available in MCAS or in AATP. you can either change the setting in AATP if the MCAS is disabled or vice versa - but not both.

There are some customers who are part of our preview program for AATP alert policies in AATP. Once the preview program is completed we will move the experience to MCAS, but until then you should use the AATP portal for that.

[#7]

@Daniel Naim I can't find this exclusion in both systems.  Please help.

[#8]

Looking where to exclude.

[#9]

@Michael Platt What does Setting > Exclusions shows you?

[#10]

I figured this out. You added the exclusion from the alert NOT from the exclusions page.

[#11]

I just found this while searching, in relation to Defender for Identity, and if others do the same I add my response here...

You will get this alert, Suspected DCSync attack (replication of directory services), when you start with Microsoft Defender for Identity. To Exclude the Azure AD Connect Server from causing this alert you can go to Settings - Identity - Exclusions by detection rule and add your Azure AD Connect server as an excluded device.

[#12]

...is the correct answer! Thanks a lot 🙂

[#13]

Has this been fixed or not yet?
I am seeing frequent FP alerts in my environment from a particular MSOL_**** account.