Honeypot catching 255.255.255.255:41794 - Windows ATP Defender - MulticastScanner V1.3.2.ps1? From windows 10 machines?

Question

What I found:

Event log that corresponds - EventID 403 Powershell Engine Lifecycle which calls upon - c:\programdata\microsoft\Windows Defender Advanced Threat Protection\Downloads\MulticastScanner V1.3.2.ps1

This powershell script appears to send out a multicast packet when parameters are passed from 41794 port to 255.255.255.255:41794.

I was able to find in the "c:\programdata\microsoft\Windows Defender Advanced Threat Protection\Downloads\" online that the other unicast.ps1 is a known file to Windows, I'm assuming the same for this Multicast.

What I haven't found:

I can't seem to find a single detail on this MulticastScanner v1.3.2.ps1. I can't seem to pin it to you know, say a Windows update. Why did this just start happening in May 2021? I'm like 99% sure this is benign, but I need an actual answer that I can point to and say, yes this is a known windows process.

Can anyone eles confirm the multicast and unicast files in their env? c:\programdata\microsoft\Windows Defender Advanced Threat Protection\Downloads\

Answer 1

Don’t worry, it is safe. From this Microsoft document we can see:
My security tool raised alert on UnicastScanner.ps1 or port scanning activity initiated by it, what should I do?
The active probing scripts are signed by Microsoft and are safe. You can add the following path to your exclusion list: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads*.ps
https://github.com/MicrosoftDocs/microsoft-365-docs/blob/public/microsoft-365/security/defender-endpoint/device-discovery-faq.md

More information here:
Device discovery overview
Standard discovery uses various PowerShell scripts to actively probe devices in the network. Those PowerShell scripts are Microsoft signed and are executed from the following location: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads*.ps
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide

-------------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.