Why am I seeing this note?
While we’ve worked hard to make sure that when a Canary chirps, you know that it matters, some network devices will occasionally touch Canaries in ways that look a lot like attacker behaviour. We want to let you know this is happening, but we also want to let you know that from our vantage point, this doesn’t look like a full-blown attack. We use these tiny but visible annotations to alert to let you know our thoughts.
What’s an AVAST Scan?
AVAST makes anti-virus & security software suites for Windows, Mac and Android machines. In some configurations (like when the Wi-Fi Inspector feature is turned on) the software will scan and probe other machines on the network.
If you have seen this annotation, we have deduced that the activity detected by this Canary looks sufficiently like an AVAST scan. This does not mean that the event should be ignored. The scan is easy enough to mimic so could be used to mask actual malicious activity. We annotate it here as an attempt to add some context to why you might have seen it.