Some customers of SecurityHive reported detections on their SMB sensors with random timestamps. After investigating this issue together with a customer, we discovered Microsoft Advanced Threat Analytics may be searching your network.

The software of Microsoft requires port 445 to be open on devices. It will ping the ports and gather information when possible. This may also trigger your Honeypot.

Exclude the Honeypot from the software or whitelist the source in the SecurityHive Portal. Whitelisting can make your Honeypot blind for an attacker which uses the source IP+Port.

More information about excluding in Microsoft ATA: https://docs.microsoft.com/en-us/advanced-threat-analytics/excluding-entities-from-detections