Rogue agent installs ?

stuarthill

We've seen a flurry of unknown agent devices come into our client's Atera companies recently.

Does anyone else experience this ?

Today's machine was called "CELESTE" and yesterday we had "GEORGE" arrive, both of which were apparently from USA IP addresses.

mbudke

Hi @stuarthill

have you sent the "Installer-Link" for the Agent via Email to an Office365 Email address?
I have experienced the same and this was caused by a security product scanning the email (e.g. Microsoft ATP, HornetSecurity etc..)

I identified this since the device was registered shortly after I sent out the link and my customer never received the email.

stuarthill

Thanks for your reply @mbudke

This is a good thought, I'll ask around and bear it in mind in the future.

sschillinger

I have also seen this a couple times, it had been AV sandboxes or similar.

That is a bummer that we can't "expire" the agent links\installers. if they get out there they could be installed on lots of devices basically forever.

gilgi

Heya - there is a resource that can be helpful - have a look:

https://support.atera.com/hc/en-us/articles/360021257599-Rogue-machines

let us know if it helps! @stuarthill