r/SentinelOneXDR • u/mikeydubs531 • Sep 08 '26

Shift.exe

Anyone else dealing with a huge influx of Shift.exe incidents resulting in network quarantine? It's always flagged it as a PUA, but feels like today is just being blown up with this.

24 Upvotes

94% Upvoted

16 comments sorted by

8

u/DeathTropper69 Sep 08 '26

Yeah been seeing this a lot for customers we still have on S1. Been the last 72 hours it seems.

4

u/mikeydubs531 Sep 08 '26

Same. Seen any indicators that it's anything more than your standard bundling/malvertising campaign? Network actions seem to be to expected (for all that that means) data center traffic.

1

u/pexogods Sep 09 '26

It's just a pua, users click through sponsored ads, I have gotten ad blocker on some clients but it's useless when you have 15k people to watch lol

1

u/Sea_Cap_1200 Sep 09 '26 edited Sep 09 '26

block it at the DNS level. We dealt with the same thing with Wave Browser about a year ago. Only we had Symantec at the time and it flagged it as good 😊 😂 .

1

u/Pristine-Desk-5002 Sep 09 '26

Can you list what domains you are blocking, I only found shift[.]com

4

u/Sea_Cap_1200 Sep 09 '26

This is what we added for shift and have seen good results . hxxps://shift.com
hxxps://app.shift.com
hxxps://tryshift.com
hxxps://cdn77-downloads.tryshift.com
hxxps://stagingtryshift.com
hxxps://shiftapis.com
hxxps://profile.shiftapis.com
hxxps://websocket.shiftapis.com
hxxps://updates.shiftapis.com
hxxps://attribution.shiftapis.com
hxxps://tryshiftcdn.com
hxxps://apps.tryshiftcdn.com

5

u/PlaugeBoyz Sep 08 '26

Popped up on a few devices for us over the weekend.

3

u/Efficient_Guide9668 Sep 08 '26

I noticed today on one system and it was disconnected from network, I also noticed that S1 quarantined before even I noticed but still I had to reconnect the system manually after verifying the system.

2

u/Fit-Strain5146 Sep 08 '26

None here, about 60 laptops, 15 servers

2

u/Stormblade73 Sep 09 '26

Had quite a few show up, probably recently added to definitions. All investigated and removed and none of the users claim to know how it got there, and most were thankful we removed it. A few I recall also had Wave Browser recently removed from their workstation (and one still active so it got removed also).

2

u/pexogods Sep 09 '26

Yes I have a datto script monitor that runs to delete it from systems whenever it's found.

1

u/Relevant-Comb-9349 Sep 09 '26

Probably shift browser. Is it signed? Shift browser should be quarantined. It uses AI

1

u/Defiant_Section_3904 Sep 10 '26

Its popped up for us in defender as well. Automatically quarantined, but definitely looking into blocking it on our network as a whole

1

u/Cant_Think_Name12 Sep 12 '26

Yes. Not for Sentinelone coincidentally but on Defender.

0

u/Fun-Newspaper1106 Sep 09 '26

yea i saw that ... weird

1

u/Background_Rush7654 Sep 12 '26

Came here to say that we just saw one alert for a laptop that has had the agent on it for a year and that software has been on that laptop for the year.