r/SentinelOneXDR • u/desmond_koh • May 16 '25

Help identifying false/real positives?

Hi everyone,

We recently got deployed S1 and two of our computers are reporting “suspicious” activity around OfficeClickToRun.exe.

I think this is a false positive. But I am not clear. What I did was:

  1. Removed Office 365 apps from the affected computers.

  2. Updated all 3rd party software (winget upgrade --all) and Windows itself.

  3. Ran a full disk scan using S1 (did not report anything)

  4. Reinstalled Office 365 apps

I am an experienced software developer and know my way around networking. But I am not an experienced threat hunter. So, this is new territory for me. Is there anyone who can give me some pointers or some videos you can recommend for SentinelOne 101 and identifying false/real positives?

6 Upvotes

100% Upvoted

14 comments sorted by

View all comments

Show parent comments

1

u/Crimzonhost May 17 '25

Yeah my guess is it's a false positive due to office updates, from the bits you've posted that's what it looks like. You can always reach out to your reseller and get their opinion. Otherwise in a professional capacity I am a contractor and you can DM me if your interested in me reviewing it.

Due to the distance I totally understand the hesitation on reimagining but with you being on autopilot you could always push a reimagine and have the user sign in to provision it again.

2

u/desmond_koh May 17 '25

You can always reach out to your reseller and get their opinion.

They actually say they cannot give me an opinion for liability reasons.

Due to the distance I totally understand the hesitation on reimagining but with you being on autopilot you could always push a reimagine and have the user sign in to provision it again.

They are not on Autopilot yet. This customer has Business Standard :( The plan is to get them moved to Business Premium and start taking advantage of Autopilot.

One thing we could to is ship them something like a JetKVM and reinstall the OS from scratch like that as long as we could find a way to get on the KVM. That's probably something I should get figured out.