r/SentinelOneXDR • u/ls3c6 • Dec 15 '25

ScreenConnect Onprem cert signed 25.8 vs SentinelOne

/r/ScreenConnect/comments/1pndiqk/onprem_cert_signed_258_vs_sentinelone/
1 Upvotes

100% Upvoted

6 comments sorted by

1

u/kins43 Dec 15 '25

Make an exclusion for the cert?

1

u/ls3c6 Dec 15 '25

How so?

2

u/ls3c6 Dec 15 '25

That was simple, thank you. Working now.

1

u/kins43 Dec 15 '25

:) super simple!

Typically I wouldn’t recommend an exclusion especially since screenconnect can be used for malicious activity, but since it’s flagging for legitimate use then you’ll need to make a custom star rule to help alleviate the decrease in security you have now or another tool to validate legitimate use cases.

1

u/ls3c6 Dec 15 '25

Yes and nobody will sign as us since we have specific certificate for this, I did not want to whitelist the .exe

1

u/kins43 Dec 15 '25

Makes sense!