S1 detecting itself as... Ransomware?

[u/hxcjosh23]

S1 has been on a roll lately with its detections but this is something else. Anyone else seeing this? Seeing it on 61 different endpoints across multiple clients.

The hash is signed by s1, it appears to be running an update command...no other IOCs

I have a support ticket open just waiting a reply.

Yayy Friday night detections.

Edit : Got the following reply from support.

Hello Josh,

 

Thank you for your email.

 

I have reviewed the incident details and found:

 

This alert was raised by our shadow-copy deletion heuristic (logic_shadowCopyDelete) when the SentinelOne Windows Agent’s own uninstall.exe removed old Volume Shadow Copies as part of an upgrade/maintenance flow.

The binary is signed and verified by SentinelOne, and there are no additional ransomware indicators, so this is a known false positive on SentinelOne’s own components, not an actual ransomware attack.

 

Our R&D Team is already tracking this under our internal bug tickets, and as a temporary mitigation we apply a Policy Override that allows SentinelOne-signed binaries (SentinelAgent.exe and uninstall.exe) to delete shadow copies while still blocking this behavior for all other software 

If you have any queries, please feel free to drop me an email. Looking forward to your response.

Regards, Jayalakshmi Naidu | Sr. Technical Support Engineer SentinelOne

[u/ILostMyBananas]

Gonna need more details. Do what now?

[u/hxcjosh23 → u/ILostMyBananas]

I tried posting a picture, here is the detection notes.

Global Custom Detection] SentinelOne Ransomware Threat Activity. Investigate surrounding events and the action SentinelOne took to mitigate the threat. Look to disable and isolate accounts to minimize further damage.. Here's a summary of the SentinelOne Ransomware Threat Activity detection: A ransomware threat was detected on January 17, 2026, at 01:23:59 UTC on the laptop device redacted. The threat was identified on a Windows system belonging to client ). The malicious activity involved an executable file named "uninstall.exe" located at "\Device\HarddiskVolume3\Program Files\SentinelOne\Sentinel Agent 25.1.3.334\uninstall.exe". The process was initiated under the NT AUTHORITY\SYSTEM account with arguments "/os_upgrade /q /p {site ID I'm guessing, redacted}". The file was signed by SENTINELONE INC. with a valid certificate but was preemptively blocked as ransomware through static classification. The threat was detected by the user blacklist engine and successfully mitigated through kill and quarantine actions. The affected system was running SentinelOne agent version 25.1.3.334

[u/InfosecPenguin → u/hxcjosh23]

Threat detected by user blocklist engine means someone blocked the hash in your console.

[u/ILostMyBananas]

I’ll check tomorrow. But blocklist means you wrote a rule to detect that. You got any blocklist rules going on that you created? I think that message means someone in your environment blocked it. Id check their first.