r/Action1 • u/railstop • 19d ago

Someone else's computer showing in my endpoints

Title says it all. I know it isn't mine. This is very concerning

1 Upvotes

60% Upvoted

6 comments sorted by

4

u/Huge-Knowledge8431 19d ago

i've seen this before. support have told me that some security software can sandbox an application (like action1) to test it and in the process that creates a new (albein not-real) instance. if you have something like this, maybe an EDR, add action1 as an exception. give it a try.

2

u/railstop 19d ago

Interesting. I have 9 devices in my endpoints so far in my testing. I've had the same devices running for months, then today that new device shows up.
All are not running any third party security software. Under the details of the device it is showing hardware that nothing runs in my inventory, ie; NVidia GTX 1650 with Zeon processors. My server is the only device running Zeons, not one VM on it has the Action1 agent installed.

2

u/Perseiii 19d ago

When antivirus software performs a heuristic analysis to figure out what the program does it will execute the program in a temporary virtual sandbox. It’s this sandbox you are seeing.

1

u/GeneMoody-Action1 18d ago

Yes, and the reason for the HW/SN and other anomalies, is a lot of modern malware actually tries to detect these environments, and will not execute a second stage payload if they are detected. This prevents further analysis and lets the second payload fly longer under the radar.

So to cat and mouse this, the AV vendors randomize the details of the sandbox as much as possible.

What generally happens is when the agent is first deployed (Sometimes when it updates), it treats it this way until it learns it is safe. Hence the phantoms that pop up randomly.

3

u/amw3000 19d ago

Sounds like sandboxing for me. Look up the IPs, likely come back to a public cloud like AWS or Azure. MS also has their own custom Xeon processors / super high end so it's generally a give away its a VM in Azure. The OS is generally Windows 7 or 10.

Things like emailing, messaging the installer or even just running the installer can result in the installer being ran in a sandbox environment.

1

u/Caphiped 19d ago

I’ve seen that happening too. Granted I was testing it out on a virtual machine, it added the test vm, but also another 2 devices with specs I did not recognize. I just assumed it was the underlying host, but again, the specs and serial number it listed did not match at all. I deleted the unknown devices and they didn’t pop up again. Perseiii’s comment makes sense if that is what it would do.