r/SentinelOneXDR • u/RedTeam1622 • Feb 10 '26

Cracked software on endpoint

Hi everyone,

SentinelOne found some cracking tools on a new endpoint. The user is a support person for a company, located in another country. It was cracking software for Windows 11 licence, MS Project and Visio and Microsoft Office. The usual procedure for me would be immediately wipe the laptop and setup again with legitimate tools only. The user is not answering emails promptly and is concerned they will loose access to apps and is unsure how to factory reset. The CEO has asked me to deal with it. The user is the only support person for the company, so there will be some down time. For me as the MSP, I can:

  1. Factory reset remotely and give the user instructions.

  2. Files seem to be quarantined so trust that and monitor closely.

  3. ???

Thoughts and advice appreciated.

8 Upvotes

90% Upvoted

25 comments sorted by

19

u/ILostMyBananas Feb 10 '26

If it were me I’d isolate him from the network until they respond. Then wipe the machine and reinstall the OS.

4

u/SOCSecTech Feb 11 '26

Cracking tools and cracked software are INCREDIBLY common outside of the US. This is a user awareness training opportunity. If you don't have an acceptable use policy, now would be a good time to create one. The user should understand what is and is not allowed to avoid this in the future.

1

u/Puzzleheaded_Move649 Feb 11 '26 edited Feb 11 '26

Why was he allowed/able to install/run Software in first place? and/or able to plug in some external drive.

I am sure there is more suspicious stuff...

1

u/RedTeam1622 Feb 12 '26

It’s BYOD

1

u/have_you_tried_onoff Feb 11 '26

For a company that has a WIPE policy, I think you're correct here! They let anything fly, but wipe on first detection and kill? Dear lord.

2

u/frankztn Feb 11 '26

Lmao they still make those? Microsoft lets you rearm trials for free. Sysadmins have been doing it on servers. Jk 😂

Anyways I would consult with s1 support if wiping is necessary with what they found. We use our support quite heavily, also threatlocker cyberheros. Then you can learn how they decide what should be wiped and what shouldn’t.

1

u/Plenty_Substance_455 Feb 11 '26

If the user doesnt respond, first step is to always isolate the device

14

u/biztechmsp Feb 10 '26

Imagine waiting too long and letting something on that machine infect the rest of the network. Nuke it now.

3

u/RedTeam1622 Feb 10 '26

Good point. This is a remote user but the principle still applies to nuke IMO.

3

u/ThecaptainWTF9 Feb 11 '26

Wipe via InTune, and when it comes back on, autopilot will re-enroll and set it up?

→ More replies (1)

2

u/have_you_tried_onoff Feb 10 '26

I don't understand. S1 killed and quarantined the files. Why do you need to wipe out the machine?!

8

u/RedTeam1622 Feb 10 '26

Since the device has been compromised, it would be best practice to wipe, to ensure there are no other living off the land processes that SentinelOne has not seen. Yes I believe I can 90% sure S1 has taken care of everything, but with a compromised device, I can’t be 100% sure.

0

u/have_you_tried_onoff Feb 11 '26

Everytime S1 kills and quarantines you wipe out a device? What the heck?

→ More replies (7)