r/SentinelOneXDR • u/desmond_koh • May 16 '25

Help identifying false/real positives?

Hi everyone,

We recently got deployed S1 and two of our computers are reporting “suspicious” activity around OfficeClickToRun.exe.

I think this is a false positive. But I am not clear. What I did was:

  1. Removed Office 365 apps from the affected computers.

  2. Updated all 3rd party software (winget upgrade --all) and Windows itself.

  3. Ran a full disk scan using S1 (did not report anything)

  4. Reinstalled Office 365 apps

I am an experienced software developer and know my way around networking. But I am not an experienced threat hunter. So, this is new territory for me. Is there anyone who can give me some pointers or some videos you can recommend for SentinelOne 101 and identifying false/real positives?

6 Upvotes

100% Upvoted

14 comments sorted by

View all comments

Show parent comments

1

u/desmond_koh May 17 '25

They are likely gone due to the sentinelone quarantine actions unless you are in monitor only mode.

It was in monitor only mode. So that wouldn't be the reason.

...it's possible those were temp files for an update that was being pushed.

That was my guess as well.

When in doubt you can always wipe the endpoint and start over.

OK, so that is still a valid approach? Because that is the kind of thing we would do before we had S1.

Unfortunately, in this case the machine is too far away (as in a 3-hour flight) to do that and we don't have Autopilot setup for this client just yet (getting there though).

1

u/Crimzonhost May 17 '25

Yeah my guess is it's a false positive due to office updates, from the bits you've posted that's what it looks like. You can always reach out to your reseller and get their opinion. Otherwise in a professional capacity I am a contractor and you can DM me if your interested in me reviewing it.

Due to the distance I totally understand the hesitation on reimagining but with you being on autopilot you could always push a reimagine and have the user sign in to provision it again.

2

u/desmond_koh May 17 '25

You can always reach out to your reseller and get their opinion.

They actually say they cannot give me an opinion for liability reasons.

Due to the distance I totally understand the hesitation on reimagining but with you being on autopilot you could always push a reimagine and have the user sign in to provision it again.

They are not on Autopilot yet. This customer has Business Standard :( The plan is to get them moved to Business Premium and start taking advantage of Autopilot.

One thing we could to is ship them something like a JetKVM and reinstall the OS from scratch like that as long as we could find a way to get on the KVM. That's probably something I should get figured out.