Correlation issue for Identity theft using Pass-the-Ticket attack and roaming users

[Justin Lipple]

Hi, 

I was wondering if anyone has experienced (what I think is) a correlation issue for the "Identity theft using Pass-the-Ticket attack" ATP alert. I believe this happens when a user moves their laptop (IP address) from one subnet to another (which for us is when a user moves from wired Ethernet to WiFi, as an example) in a short period of time.

We seem to get a few false alerts under the PTT or PTH banner as a result. When investigating further by way of DHCP logs etc, it is discovered that the machine (MAC address) is in fact the same machine.

[#2 · Accepted solution]

Hi Justin,

This is right in case of PTT.

In some cases, where the IP addresses are changing rapidly, Azure ATP might not be able to determine if different IP addresses are used by the same computer, or by different computers.

This is a common issue with undersized DHCP pools(VPN, WiFi, etc.). DHCP pools with short lease times or shared IP addresses (NAT devices).  you can find it in our suspicious activity guide: https://aka.ms/atasaguide-ptt

Thanks,

Tali