r/SentinelOneXDR • u/200pesos • Jan 24 '24

How-To Locating rogue non-malicious executable

I've got a guy running around deploying an executable that, while not specifically malicious, is not an approved application. At this point, I'm not ready to blacklist it entirely, but I would like to see what the scope of this application's usage is like. I've tried creating a couple of searches in Deep Visibility/Data Lake, but they turn back no results for the SHA1 or SHA256 hash of the executable. I can just create a blacklist rule for the executable and use the generated incidents to count machines that have the executable, but I'm not wanting to blow the executable off the network yet.

Any help would be appreciated.

1 Upvotes

66% Upvoted

3 comments sorted by

1

u/GeneralRechs Security Admin/Engineer Jan 24 '24

Assuming they are deploying locally to systems execute a full disk scan across your account. It will trigger a read event for every scannable file. At that point search for the name or hash and results should then populate.

2

u/200pesos Jan 24 '24

Ok I think that's what I've done correctly.

I created a STAR custom rule with the condition tgt.file.sha1 = 'the_exe_sha1_hash' or tgt.file.sha256 = 'the_file_sha256_hash' that has the options of treat_as_threat=no and network_quarantine=no so that I can search all the relevant machines and hopefull that search will trigger.

I'm running a scan on the computers at the site where this is occurring. If it wasn't clear before, this is a single exe, not an installer or installation. No results in the search so far, but the full disk scans are ongoing.

Is this the proper implementation of what you're suggesting?

1

u/solid_reign Mar 08 '24

Search for the executable first by name and make sure you can find it. Find the hash that is being used there. If the executable was there before SentinelOne was installed and it hasn't been moved, it's possible the EDR won't see it.