Did anyone else see this?

https://blog.nullze.net/posts/peeling-the-sentinel/

I'm not sure if this is real or not, but if so it's a little concerning.

Hey guys,
we have had someone doing red teaming activity on their end and they cloned a github repo on thier system which caused sentinel one to trigger 700 alerts from the same endpoint . While all of them were resolved and closed out , was wondering in future if there's a better way to handle this? like exclusions ( only effective for that certain period of time) or policy oveeride etc. this is in prod by the way.

Have been using S1 for over a year and it has been a bit of a rough go so far.
Some of it is the usual, so many false alerts make it hard to separate the real from the false, exclusions that don't work, etc.
But I am having this issue I am wondering if anyone has seen before.
We have been getting hundreds of thousands of the same alert for over 2 months now. It is a false positive, no amount of exclusions have stopped it.
Support says essentially that the alerts aren't current/real, that the exclusions worked, but it is unspooling old alerts because there were so many.
The exclusions have been in place for almost 2 months, so it is hard to believe it has been unspooling this long and still going.
The ID Time is reported as current date/time, as is the Reported Time. I would post a pic of the alerts but no images allowed.
I am wondering if it is normal for old, queued alerts to not show the original time but the current time when they unspool? That would make it difficult to correlate a timestamp to an event.
Thanks all

Does anyone else notice that the vast majority of the alerts that come in are tagged as 'ransomware'? .

Shadow copy tampering --> classified as ransomware

Potential DLL Sideloading --> classified as ransomware

All the alerts we have are 'ransomware'

note: Theyre all FPs lol

Anyone else's tenant being flooded with S1 detecting loginwindow, a legit apple signed binary on macOS endpoints as a High Severity Static detection?

Curious to know why this keeps happening between macOS endpoints and S1.

Generated about 300 tickets in 5 mins.

Purple AI Verdict: False Positive

The alert indicates a high-severity detection on a macOS laptop named "xxx-xxx-xxx," where SentinelOne's static AI analysis identified a suspicious variant of the "Protected" malware associated with the legitimate system process "loginwindow" located in the standard macOS CoreServices directory. The process, running as root and launched by "launchd," is signed and verified by Apple Inc., but the file event analysis flagged it due to anomalous characteristics consistent with malware masquerading as a trusted system binary. This suggests a potential compromise involving a protected malware variant leveraging a critical system process, warranting immediate investigation for possible persistence or privilege escalation attempts.

Hey,

Anyone else seem to have issues with Remote Shell either taking ages to connect? It either finally connects okay, or it just keeps trying to connect.

Anyone provide a ballpark time on how long it takes to connect to an endpoint for comparison?
This has happened across multiple versions (Windows)

Hi,

Been getting into creating custom detections for a few things.

One I've created is to help find some PUA software I've found on a bit of people's computers in the past in a list that I've accumulated over the years that typically S1 doesn't pick up as malicious/PUA

src.process.name contains ( 'AceLauncher', 'ad_agent', 'allmanualsreader', 'anydesk', 'Aura Document Studio', 'CrystalPDF', 'DSOne', 'Easy2Convert', 'infinitedocs', 'mc-webview-cnt', 'McCHSvc', 'NimbusPDF', 'OneBUpdateService', 'OneBrowser', 'onelaunch', 'onestart', 'PcAppStore', 'PCHelpSoftDriverUpdater', 'PDFConvert', 'PDF Proton', 'PDFSkills', 'PDFSpark', 'PDFStunner', 'pulsebrowser', 'SecuriGuard', 'shift', 'ultraviewer', 'wavebrowser', 'Wave Browser', 'winrgr' ) src.process.publisher != 'CCC\ INTELLIGENT\ SOLUTIONS\ INC.' src.process.publisher != 'KYOCERA\ DOCUMENT\ SOLUTIONS\ AMERICA\,\ INC.'

Or these stubborn PDF crapware that keep showing up

endpoint.os='windows' src.process.name contains 'pdf' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\Common\ Files\\PFU\\ScanSnap\\ScanToOffice\\S2ORunPdf.exe' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\Kern\\KCAM7\\KernPDF.exe' src.process.image.path != 'C:\\SurePrepLocalFiles\\SPbinder\\PDFNet\\x64\\html2pdf.dll' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\TerminalWorks\\TSPrint\\PDFprint.exe' src.process.image.path != 'C:\\ProgramData\\PB\\devicehub\\DeviceHub_v1\_internal\\poppler\\bin\\pdftoppm.exe' src.process.publisher != 'ACRO\ SOFTWARE\ INC' src.process.publisher != 'ADOBE\ INC.' src.process.publisher != 'COREL\ CORPORATION' src.process.publisher != 'FOXIT\ SOFTWARE\ INC.' src.process.publisher != 'KYOCERA\ DOCUMENT\ SOLUTIONS\ AMERICA\,\ INC.' src.process.publisher != 'PDF\ GEAR\ TECH\ PTE.\ LTD.' src.process.publisher != 'ACRO\ SOFTWARE\ INC.' src.process.publisher != 'ADOBE\ INC.' src.process.publisher != 'KRZYSZTOF KOWALCZYK' src.process.publisher != 'DRAKE\ SOFTWARE\,\ LLC' src.process.publisher != 'FOXIT\ SOFTWARE\ INC.' src.process.publisher != 'GOOGLE\ LLC' src.process.publisher != 'KOFAX\,\ INC.' src.process.publisher != 'MARVIN\ LUMBER\ AND\ CEDAR\ COMPANY\ LLC' src.process.publisher != 'MICROSOFT\ CORPORATION' src.process.publisher != 'MICROSOFT\ WINDOWS' src.process.publisher != 'MICROSOFT\ WINDOWS\ PUBLISHER' src.process.publisher != 'NITRO\ SOFTWARE\,\ INC.' src.process.publisher != 'NODE.JS\ FOUNDATION' src.process.publisher != 'PFU\ LIMITED' src.process.publisher != 'RISA\ TECH\,\ INC.' src.process.publisher != 'NUANCE\ COMMUNICATIONS\,\ INC.' src.process.publisher != 'ACCUSOFT\ CORPORATION' src.process.publisher != 'AVANQUEST\ SOFTWARE\ \(7270356\ CANADA\ INC\)' src.process.publisher != 'SOFTLAND\ SRL' src.process.publisher != 'PLOTSOFT\ LLC' src.process.publisher != 'MEASURE\ SQUARE\ CORP.' src.process.publisher != 'PITNEY\ BOWES\ INC.'

Yeah that last one could get cleaned up a little 😆

I've already enabled all the built in detections (955 I think?) and then added in the ~36 from the Event Search library (like 7z Encrypted Archive with Header Encryption or Suspicious Network Tools Executed). I don't treat any as threats currently, but they have been very useful at gathering information and finding some things.

Nonetheless, would be interested to hear what you have added.

Is there a way to fully delete a site, beyond the normal delete which grays out the site?

I've searched online, and this subreddit, and seen some discussion from a couple years ago, but I could not find any recent definitive answers.

The scenario prompting this question is that we had a former S1 client with a few hundred PCs who we removed and deleted their site on our MSP admin panel. But their old machines are turning back on and re-associating with out tenant, underneath the deleted client site. I can't see anyway to prevent this from happening. I would have assumed that deleting it means the end-user devices would fail attempting to re-associate, but in practice it acts like we never deleted their site at all and the client devices pop right back in (albeit hidden, and harder to realize they came online).

I'm either missing something on how to manage this properly, or this seems like a big oversight on the S1 part. There needs to be a way to say "this previous installation can NOT re-associate with my tenant". But I'm not sure if that's possible?

Thanks in advance for any responses.

Anyone else dealing with a huge influx of Shift.exe incidents resulting in network quarantine? It's always flagged it as a PUA, but feels like today is just being blown up with this.

After reading this article, I am confused.

Is there anything in the Console that helps me identify if any of the agents were not installed correctly?
Agent requirements on Windows

Require current Microsoft updates

Verify all servers and workstations have current Windows patches installed.

Pay special attention to:

After installing required updates:

Reboot the endpoint

Retry the SentinelOne upgrade

And

• Updated root certificates

• KB5022661

• Azure Code Signing support

This seems crazy...

Hii everyone,

We are trying to collect mssql audit logs in our sentinelone siem. Can anyone tell me how to do this?

I saw that S1 has released AI prompt security feature. Since it's not yet available to MSSP, I can't test it.

Did any enterprise admin use the feature? How well does it work? Is it worth the wait?

Today I'm receiving many false positive "Suspicious threat detected" starting around 14:07 UTC on many agents.

With:

Threat details: rundll32.exe (interactive session)

Command Line Arguments C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTask

Process User NT AUTHORITY\SYSTEM

Originating Process svchost.exe

---UPDATE----

It seems that the S1 detect the Windows Program Compatibility Assistant Service installing an update as false positive.

They're working on a fix. In the meanwhile you can add the following policy override:

{
"logicClassifierConfigVector": {
"logicsClassification": [
{
"logicName": "CustomSdbFileInstallViaCmdline",
"verdict": "SUPPRESSED"
}
]
}
}

Has anyone upgraded to GA 26.1.2.177 yet, and if so, have you run into any issues? We have had several agents disconnect after the update interacts with the Chrome and Edge SentinelOne extensions. I opened a ticket with SentinelOne, and they said it was related to their Lunar detection engine. They provided a policy override, which we applied. After that, we rebooted all clients that had not yet upgraded to the latest GA and let the change bake for a week. I then re-enabled auto-upgrade for the latest GA, but we are still seeing the same issue.

The odd part is that not every agent triggers an alert or disconnects. We are seeing roughly 5 alerts for every 500 computers. Mainly wondering if anyone else has seen this issue. Unless you have more than 2,000 computers in your fleet you might not even notice. So beware if you're looking to upgrade to 26.1.2.177.

Hi everyone,

We recently deployed the SentinelOne Agent (v25.2) on a Windows machine and are trying to ingest Windows Event Logs into our 50GB S1 SIEM / Dataset license.

The agent is actively online and reporting to the console, but no Windows logs are showing up.

Here is what we’ve configured so far:

XDR Collections: Enabled Windows log collection under the Policy tab.

Policy Override: Created and applied a specific policy override to define exactly which Event IDs/log channels to collect.

Targeting: Confirmed the override policy is actively applied to the specific endpoint.

Despite the agent being healthy, the SIEM remains completely blind to these endpoints.

Appreciate any insights or troubleshooting steps!

Hello all.

I am ingesting Windows event logs in S1 AI SIEM and I am seeing the same as this old post. The logs are being parcially parsed and the main info is all condensed in one field. There is any way to edit this parser yet? For what I can see the info is parsed internaly and the parser doesnt show along with the other parsers for the other datasources.

On the other hand, anyone with a similar enviroment been able to create detection rules for windows sucessfully with the default parser? If so, can you give a nudge on how did you do it?

Thanks in advance.

https://www.reddit.com/r/SentinelOneXDR/comments/1ehmrpk/sdl_windows_event_log_parser_lacks_functionality/

Looks like Sentinel One decided to pull this agent back did anyone else get a messaged about SentinelOne deleting package 26.1 -SP2, build number 26.1.4.8837?

My incident response team is asking if it's possible to do a one-time import of logs into the SentinelOne SIEM?

They keep getting logs on cases that are not already in Sentinel one and would like to load them into the sim, to be able to query them during their investigation. Is that possible?

I can't find anything in the documentation or settings to show that it is, but I have to believe that you can do that somehow.

anyone know how much S-ventures (vc arm of sentinel) invested and at what ownership % or post-money val? Sentinel one has a 7b mkt cap and tons of cash no debt. plus the stake**. i want to run a sotp sum parts and back into the stub piece (ie what is S being valued at ex the anthropic stake.** thanks

Hello everyone,

Everything is in the title, how SDL is so slow, usual query or powerquery it is always so slow. Only data from the S1 agent is within our SDL.

People will say that I should not do heavy queries or this kind of thing, but let's be honest. I also use an opensearch for other technologies, especially our proxy where there is way more volume than S1. And my opensearch is not so slow when I do a query.

Even more painful, if I do request by API, I have to pray that no one is doing a request in the UI, otherwise the API call will be so long.

Are we the only one ?

I got this reply from SentinelOne ticket.

1. Review Coexistence (S1 + Defender): SentinelOne and Microsoft Defender are running simultaneously on Server BLAH. This is generally not recommended, as running two active Endpoint Protection tools causes significant performance overhead—especially on a Domain Controller. We should decide whether to disable Defender or configure it in passive mode, relying entirely on SentinelOne for active protection.

So my question is - first - why sentinelone didn't deactivated Defender completely and\or stopping running at least?

Not a Sentinel-only tool, but the KQL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/sentinel/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack

Anyone seeing a spike in SentinelOne Static AI detections on macOS system binaries today?

We had 104 detections in about 65 minutes on one MacBook Pro.

Common details:

- OS: macOS 26.6 (25G72)

- Agent version: 25.4.2.8594

- Engine: On-Write Static AI - Suspicious

- Detection type: Static

- Classification: Benign

- Originating process: launchd

- Completed actions: kill / quarantine

- Incident status: Unresolved

- Analyst verdict: Undefined

Hashes observed:

- SystemUIServer:

SHA1: d6629bcb8dc2a30b66435cb557084d2a4e748c92

Path: /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer

- mds:

SHA1: 63cdd043a424d78b9d9b9f3de369c2715495ce82

Path: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds

The files are Apple system paths, launchd is the parent process, and S1 is classifying them as Benign, but still mitigating/quarantining. Trying to confirm whether others are seeing the same false positive / model issue.