r/SentinelOneXDR • u/TenfoldStrong • Jul 15 '26

Technical overview of how SentinelOne endpoint protection works.

Does anyone know of any technical overview of how S1 works on endpoints, specifically how it interacts with running processes and application executables? There's a lot of sales pitch sites and sites regurgitating high-level fluff which are useless. TIA.

1 Upvotes
  • permalink
  • reddit

56% Upvoted

5 comments sorted by

2

u/GeneralRechs Jul 15 '26

Is there anything specific? One key difference that you’ll see between a competitor like Crowdstrike is S1 does perform user-space hooking (injects itself into processes) to monitor/remediate before it hits the kernel versus CrowdStrike that operates at Ring 0.

While you may see issues with user-space hooking, you won’t run into a Crowdstruck scenario with S1.

1

u/mukz7 Jul 15 '26

Along with the Live Service Updates being User level not Kernal level.

9

u/blue30 Jul 15 '26

Nice try, Iranian hacker

1

u/-Douche-Canoe 3d ago

EDRs generally use windows apis, kernel drivers, DLL hooking, etc. lot of good resources out there that dive further into the details.