9,656 questions
ALERT: Password reuse activity - Behaviour
Sergy Lopez
161
Reputation points
Hi Everyone.
Recently we receive a bunch of the next Alerts!: Password reuse activity that is triggered every 3 minutes on Microsoft 365 Defender.
The question here is, if anyone known the behavior or parameters that this alerts use to trigger the alert by default.
We analyze the entities that was envolved on this scenario, and all the applications are internal applications that present on it.
also we detect that only the entities that use Windows 11 are triggered but not the entities with Windows 10.
Kind of regards.
Microsoft 365 and Office | Install, redeem, activate | For business | Windows
Microsoft Security | Intune | Security
503 questions
Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud Apps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 78%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECO%3C/text%3E%3C/svg%3E)
Connor O'Brien 10 Reputation points2023-04-20T06:07:16.21+00:00 It seems to be a global issue with SSO applications. I found multiple rededit and other forms reporting the same thing when our first alert come through.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 19%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
Knapp Maximilian 21 Reputation points2023-04-20T07:14:38.0933333+00:00 We haven't received any "messages" since roughly 25 minutes, can anybody confirm if they also don't receive any more messages?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 62%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Heine Lysemose 5 Reputation points2023-04-20T08:33:47.4433333+00:00 It stopped here too around 08:00 CET
-
Heine Lysemose 5 Reputation points
2023-04-20T08:36:13.3166667+00:00 It stopped here too around 08:00 CET
-
Sergy Lopez 161 Reputation points
2023-04-20T15:54:30.8533333+00:00 Yhea it looks like it was issue with this alert implementation, the last Time that we saw the alert wast at 07:00 CET, so it looks like it was fixed, removed or something like that, i will keep in eye if something change.
Sign in to comment
Sign in to answer