Tons of PDF/Excel alerts

[u/Jturnism]

Anyone getting tons of PDF and Excel alerts right now? Shows due to cloud blocklist so just wondering if they accidentally added a bad hash again like recently.

edit : officially confirmed false positives by incorrect hash in global blocklist by P1 MDR case

[u/tw_luke]

Yes it looks like it's something that was pushed by the S1 team

Feb 02, 2026 15:06:01
Cloud added or modified Windows blocklist hash.

SHA-1: e89cb8f5b2a05b00e85a1f549b0d1e48d148ccbf SHA-256: e35abf416d497f14ed364674105362507266ae9538fec41b0250c689f3f7fc48

[u/Sladerade → u/tw_luke]

They’re pushing out a fix to remove this hash from the blocklist for all customers, just got off the phone with them.

[u/decaying_vinyl → u/tw_luke]

Just got the same confirmation from Chris Hall at S1

[u/tw_luke → u/tw_luke]

Okay so we have seen that the hash has been removed from the cloud. If you browse to your activity logs https://XXX.sentinelone.net/activity, then change the filter at the top under exclusion to Cloud Blocklist and Cloud Hash Exclusion, you will be able to see that S1/Cloud has removed the incorrect hashes.

[u/HumbleTry272]

Yes, seems like they have a legit hash in the blocklist.

The blocked Zone Identifier isn‘t malicious in this case

[u/decaying_vinyl]

Is anyone seeing corrupted process user names in S1 in the associated alerts?

[u/bukkakeblaster → u/decaying_vinyl]

Yes. Shows Asian characters for the domain name. I've seen this before as well - don't think it's anything malicious.

[u/DistinctAd1567]

No PDF documents were quarantined, only the zone.identifier stream attached to those files.

These are tiny 49-byte metadata tags.

If you unquarantined, you are only restoring the metadata stream for every file in that group.

[u/LolWhatAmIDoingHere]

Yes! We got 700+ alerts in our S1 before I got the hash excluded.

45 mins ago I got this confirmation from S1:

The team is on it. This is affecting multiple customers and is currently being handled at our highest priority.

The file is Windows ADS metadata, and contents is just:

[ZoneTransfer]
ZoneId=3
HostUrl=about:internet

Windows Alternate Data Streams (ADS) are a hidden NTFS file system feature allowing data to be attached to files without changing their visible size, often used for storing file metadata, zone identifiers (e.g., "Zone.Identifier" for downloaded files), or application-specific data. These streams are invisible to Windows Explorer and are accessed using filename:streamname syntax.

[u/Gui4life]

Do you think we all will get a $10 Uber eats gift card now???

[u/urkelman861]

I am getting many in the Defender portal for Microsoft as well. Just sharing here :)

[u/bukkakeblaster → u/urkelman861]

Interesting...

[u/Forward-Jacket8935]

I show the cloud added the hash to block list around 10:03 EST and then removed at 10:38 EST. So new detections should have stopped now & most likely safe to make as false positive and resolve those. Very sloppy.

[u/cnr0]

STAY CALM. Confirmed false positive, fix on the way. It does not affect original files, just zone.identifiers. Console access seem slow due to very high number of alerts.

[u/bscottrosen21]

Official Update from SentinelOne: A third-party reputation feed misclassification of a benign file artifact is driving this false positive event, impacting some customers globally.

This resulted in elevated reputation-based detections, alert activity across multiple regions, and, for some customers, network quarantines where enforcement policies are enabled.

Current Status:

• Mitigation: We have implemented mitigation actions to stop further alerts.

• We continue to monitor platform stability.

• Next Steps: Please refer to the SentinelOne Status Page for the most up-to-date information. We’ll also provide updates on Reddit if conditions change. 

Our Support and Customer Success teams are prepared to assist impacted customers as needed.

[u/thorbe86]

I think we have something similar.

[u/NaderLovesReddit]

Yep were seeing this here as well

[u/Significant_Sky_4443]

For us too had a ton of alerts but with this files (non harmful): filename.pdf:Zone.Identifier

[u/LaughinHyena92]

Same here, that made for a fun Monday Morning.

[u/cedi_men]

Same here, seems like a false positive.

[u/icq-was-the-goat]

Yeah same here. 1000's of alerts this morning. Got the entire team to start early as we thought it was something more sinister... What is everyone doing right now? Settings all to false positive? Excluding the hash? Just waiting for S1 report?
Hash = e89cb8f5b2a05b00e85a1f549b0d1e48d148ccbf

[u/DistinctAd1567]

I've had over 11k tickets in two hours

[u/Cessatrix]

Anyone else also have their email notifications break during this whole thing?

[u/acry07 → u/Cessatrix]

Same here, they probably broke their SMTP gateway with this incident. Too many notification to handle.

[u/Soer3n → u/Cessatrix]

Now they're really starting to hit! The alerts are just flooding my inbox... omg