Mass amount of pass the ticket

Hi!

We have been detecting the massive ammount of pass the ticket activity in our AD. There is an alarm generated in ad monitoring system every minute. No technique or process created or used that would indicate that the attack is pass the ticket(no mimikatze or rubeus). I would like to know how the microsoft decides if the attack is pass the ticket. according to which parameters and fields. If it is configuration issue then we would like to fix it immediately.