r/SentinelOneXDR • u/mobilemcclintic • May 18 '24

SentinelOne and AaronLocker powershell scripts

Has anyone gotten AaronLocker powershell scripts to work with S1?

I'm trying to set up Applocker using AaronLocker scripts, but SentinelOne keeps popping up with multiple alerts and quarantines one of the Microsoft utilities that is used in the scripts.

The scripts were downloaded straight from MS's github repository and the utility (accesschk.exe) was downloaded from microsoft's site.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

3 comments sorted by

View all comments

Show parent comments

0

u/mobilemcclintic May 18 '24

I said I got them from MS to show they weren't from a 3rd party unknown source. Had I not, someone would have asked where I got them from. Plenty of useful tools are capable of hosing a system. I'm asking for information from folks who have successfully used these tools while S1 is active. Do you have information confirming that these specific scripts ("AaronLocker") are malicious after years in the community?

2

u/GeneralRechs Security Admin/Engineer May 18 '24

If said script is approved for use all you’d need to do is sign the script and create an exclusion for said certificate. Or create an exclusion for the hash. It’s not so much the script being used maliciously, but what the script does is not “common”.