Forum Discussion
fooUser appearing in Sentinel device logs
The backend Team at inTune is working on a fix for the issue currently. Here was the official answer of what occurred:
'This user does not represent a security threat. As part of the DLP (Data Loss Prevention) service, an attempt is made to identify users associated with machines. Recently, changes were implemented to the fallback method for WAM user fetching. In hybrid join scenarios, there are instances in which a domain user cannot successfully be resolved to an AAD (Azure Active Directory) user identity and in these instances, the auto-join identity (foouser) is returned. Microsoft is evaluating both short- and long-term solution to filter out DLP requests and alerts associated with foouser.'
Have a support ticket open with MS for this also.
Some things that I was concerned with was the huge amount of data seen in use by the foouser account across over 500+ apps seen in Defender for Cloud Apps (MCAS)
Example, why is foouser account seen to be using (upload and download) for Gmail if it's just used for Intune enrollment? How can we determine which actual user is involved in certain activity when MCAS just shows the foouser account?
If we ever did have a major incident and the foouser UPN account was being shown in the logs instead of the actual users UPN (as we are currently seeing at times) wouldn't this be a big issue in regards to collecting forensic investigation logs in regards to the actual user, as all we can see is the foouser instead. This would also be a great way for a bad actor to hide their tracks, by hiding in plain sight. It's that part that concerns me, especially when thinking about potential data exfiltration.
I can also see that it is seen on 128 devices (never more) but less at the W/E (potentially where users machines are off) - what is significant about the number 128 as we have way more Intune enrolled machines that that, so would have expected this to be seen on all devices?
It shows in 11 tables for us when checking Rod_Trent query:
search "fooUser"
| distinct $table
Glad this is getting some traction though from MS
Brok3NSpear Very good and valid points made here.
- Yes, spot on. It looks a lot like impersonation which makes it quite alarming. It's also frustrating when support reps don't seem to immediately grasp the concern. One would think they would know the Windows ecosystem well enough to understand that this type of sudden appearance of an obscure account name should trigger immediate escalation.
Even though the name is used in certain Intune processes, that's definitely not what it is mostly known for.
Good catch with the 128 devices, I see the exact same thing.
I noticed that when I opened a file on a computer, fooUser would show up in events for creating the link to the file in the "Recent files" section in Explorer and similar actions that the system performs behind the scenes during such user activites.
