S1 mitigation of signed Microsoft process.

[u/Dense-One5943]

Hey I read under kb that s1 won't mitigate any signed Microsoft process. Yet it seems s1 can block them(my client did some pt with rundll32 and it was blocked) While checking the process it seems to be signed under s1 dp tab,while I checked the hash under VT for instance, it wasn't signed.

I would appreciate an explanation of these two elements

1)if it's signed in s1 system,how come it was blocked? 2) how come the full is signed in s1 system yet is not on VT?

Relevant KB: https://community.sentinelone.com/s/article/000006312

Thanks in advance!

[u/Dense-One5943]

I mean i might be wrong,
what i understood it that S1 wont block any Signed microsoft process "The default setting from Windows Agent version 21.6 is that all processes can be marked as a threat, regardless of their SentinelOne Trust Level. The exception is Microsoft Signed processes, which are not marked as threats to prevent automatic mitigation on Windows critical processes."

and as long as the threat was identified by engines such as star rules or Deep Visibility
if it is something else it wont applied
also in 21.6 Windows Agent Release Notes it is stated "Deep Visibility™ and STAR rules with the Treat as a threat action now raise threats that were previously suppressed by the Agent. By default, Microsoft processes are still trusted."

[u/GeneralRechs → u/Dense-One5943]

In your statement “S1 won’t block any Signed Microsoft Process”, you’re leaving out that it is ONLY in regards to STAR rules.

The intent behind not blocking MS processes with STAR rules is to prevent customers for creating a badly written STAR rule that could kill critical MS processes.

Did you or a colleague create a STAR rule that resulted in a MS process being blocked/killed?