Team: Huntress EDR
Product: Huntress, Microsoft Defender for Endpoint, and Microsoft Defender management portals
Environment: Windows, macOS, Linux
Summary: If you ever notice an agent installed in your account that you didn't deploy, don't recognize the machine name, and you are using a security tool like Microsoft Defender for Endpoint (MDE) or have set Defender AV Cloud Submission Samples (MAPS Reporting 2, Submit Samples Consent 3) to submit at the highest level then this article is for you.
Essentially, Microsoft will sometimes spin up a VM in the Microsoft cloud when it encounters certain software, this VM will have a copy of your Huntress agent that the VM will use to register that Huntress agent to inspect what the program (Huntress) does. This doesn't expose your account, any of your info, and is harmless, however you will need to uninstall this agent (using your Huntress portal) to prevent it from counting against your agent totals.
If in doubt, please contact Huntress Support and we'll be happy to assist!
Key Indicators (your mystery agent should have most of these):
- External IP doesn't match the External IP of any other machine on the same network or organization. You can take this a step further and perform a WHOIS lookup on the External IP, most of the time you should be able to determine the owner. If it's Microsoft, there is a high chance this is just a clone spun up by Microsoft.
- The new agent isn't sending in any data and appears to be offline (Last Seen > 10 minutes). The check that Microsoft performs on the new VM is very quick and the agent will go offline almost as soon as it came online. You can verify the "no data" aspect by looking for "Last Survey" in the Agent landing page. Screenshot below may have the data arranged slightly different, but the key information will be there.
- If even one machine in this organization is running Microsoft Defender for Endpoint or has Cloud Submission Samples (MAPS Reporting) set at a high level that is enough for Microsoft to spin up a clone of Huntress in their cloud. If MDE is the cause, a running service named "msssense" would appear in at least one machine in that network/organization (MDE was formerly called ATP).
This may also be caused by MAPSReporting set to advanced (2) if cloud samples is set to submit automatically (3), please note these are not the default settings. You can use this command to test:
Get-MpPreference | Select SubmitSamplesConsent, MAPSReporting
- 5-6 letter random name for the new machine. This schema may change at any time with no warning, so this isn't a concrete indicator.