11 minhigh
Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse | Akamai
Akamai researcher Shahak Morag demonstrated a 'Bring Your Own EDR' attack chain at DEF CON 34, abusing SentinelOne's exposed COM interfaces and installer validation to turn the EDR into a Trojan horse. By leveraging the SentinelHelper.1 COM object's Dump method, a local admin can dump any PPL-protected process, then chain this with PPLSystem to achieve unsigned code execution inside PPL processes such as Windows Defender. The attacker can install a rogue SentinelOne agent without a valid license, block management telemetry via local DNS manipulation, and use the EDR's own anti-tampering mechanisms to protect malicious payloads. The vulnerability was fixed in SentinelOne Agent version 26.1.1.
Sens:▲ 24h
Showing defanged values
- filenameDiagnosticsCollector.ps1SentinelOne diagnostic PowerShell script that legitimately calls the Dump method — used as a template for the attack
- filenameindicator.dllUnsigned DLL loaded into Windows Defender (MsMpEng.exe) PPL process during proof-of-concept code injection
- filenamep_indicator.shc2.exeFinal modified PE with 8 sections (added .overlay section) used for PPL process injection
- filenamep_indicator.shc.exePE file converted to shellcode using PE_TO_SHELLCODE, modified to add overlay section for PPL injection
Detection / Hunteropenrouter
What Happened
A security researcher found a way to turn a popular antivirus and security monitoring tool (SentinelOne) into a weapon against the very computers it is supposed to protect. By obtaining a copy of the SentinelOne installer (which is widely available online) and having administrator-level access to a computer, an attacker can install a fake agent that looks like it is protecting the system but is actually doing nothing. The researcher then showed how the security software's own built-in tools can be used to inspect and hijack other highly protected system processes, including Microsoft's own antivirus. Finally, the attacker can use the security software's file-protection features to make their malware nearly impossible to detect or remove. Organizations using SentinelOne should update to version 26.1.1 or later, which fixes this issue, and should review who has local administrator access on their endpoints.
Key Takeaways
- SentinelOne's exposed COM interface SentinelHelper.1 allows any local admin to dump PPL-protected processes without kernel exploits or vulnerable drivers
- Chaining the process dump capability with PPLSystem enables unsigned code execution inside PPL processes like MsMpEng.exe (Windows Defender)
- SentinelOne's MSI installer site token validation can be bypassed with a crafted Base64-encoded JSON pointing to localhost, allowing rogue agent installation without a valid license
- sentinelctl.exe unprotect/protect commands can be abused to wrap malware in SentinelOne's own anti-tampering protections, making files inaccessible and processes untouchable
- Management telemetry can be blocked by modifying local hosts file to resolve the management URL to 127.0.0.1, while the agent still reports a secure state
Affected Systems
- Windows 8.1 and later (Protected Process Light model)
- SentinelOne Agent versions prior to 26.1.1
- Microsoft Defender (MsMpEng.exe) — targeted as PPL injection victim
- Other EDR vendors (unnamed) — hardlink-based binary modification technique demonstrated
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Obtain a SentinelOne MSI installer from publicly available sources uploaded by customers
- Installation: Bypass site token validation by crafting a Base64-encoded JSON with localhost URL and arbitrary site_key, installing a rogue non-licensed agent
- Reconnaissance: Enumerate exposed COM objects (SentinelHelper.1, SentinelAgent.1, SentinelUI.1) and identify the unprotected Dump method
- Credential Access: Use SentinelHelper.1 Dump method to dump PPL-protected processes (SentinelAgent.exe, MsMpEng.exe) and extract COM secrets
- Execution: Chain with PPLSystem to map unsigned shellcode (converted via PE_TO_SHELLCODE) into PPL process, fix page permissions and relocations, create thread via NtCreateThreadEx
- Defense Evasion: Block management telemetry via local hosts file redirect to 127.0.0.1; use sentinelctl.exe unprotect/protect to wrap malware in EDR anti-tamper protections
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The research is conceptual and proof-of-concept focused, describing techniques and code snippets but no deployable detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The entire attack chain is designed to operate within or abuse PPL-protected processes, which EDRs typically cannot inspect. The rogue agent installation and COM object abuse occur within trusted security software context, making EDR telemetry unreliable or absent. |
| Network Visibility | Low | The attack deliberately blocks management telemetry by redirecting DNS to localhost. The only network artifact is a potential HTTP request to 127.0.0.1:8888 for newer SentinelOne versions, which is local and would not traverse network sensors. |
| Detection Difficulty | Very Hard | The attack operates within PPL-protected processes that are inherently opaque to monitoring tools. COM interface abuse appears as legitimate diagnostic activity. The rogue agent installation mimics a valid SentinelOne deployment. DNS-based telemetry blocking is indistinguishable from legitimate local configuration. Detection requires correlating multiple low-fidelity signals across process, file, and network telemetry. |
Required Log Sources
- Windows Event Log - MSI Installer events (Application log, MsiInstaller source)
- Sysmon Event ID 1 (Process Creation) for sentinelctl.exe unprotect/protect commands
- Sysmon Event ID 7 (Image Load) for DLLs loaded into MsMpEng.exe or SentinelAgent.exe
- Sysmon Event ID 8 (Remote Thread Creation) for NtCreateThreadEx calls into PPL processes
- Sysmon Event ID 11 (File Creation) for dump files and temporary MSI validation DLLs
- Windows Event Log - Service Control Manager events for SentinelOne service state changes
- PowerShell Script Block Logging (Event ID 4104) for COM object instantiation and method calls
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for SentinelHelper.1 COM object instantiation via PowerShell, which may indicate abuse of the Dump method for PPL process dumping. Legitimate use is limited to SentinelOne's own diagnostic scripts. | PowerShell Script Block Logging (Event ID 4104), Sysmon Event ID 1 for PowerShell process creation with COM-related command lines | Credential Access / Defense Evasion | Medium — legitimate SentinelOne diagnostic activities may trigger this; correlate with user context and whether DiagnosticsCollector.ps1 is the calling script |
| Consider hunting for sentinelctl.exe being invoked with unprotect or protect arguments by non-SentinelOne processes, which may indicate an attacker manipulating tamper protection state to shield or unshield malicious files. | Sysmon Event ID 1 (Process Creation), EDR process telemetry | Defense Evasion / Persistence | Low — sentinelctl.exe unprotect is rarely used in normal operations and should be investigated |
| Consider hunting for MSI installation of SentinelOne agent from non-standard paths or without corresponding management console deployment events, which may indicate a rogue BYOEDR installation. | Windows MSI Installer event logs, EDR software inventory changes, Sysmon Event ID 1 for msiexec.exe | Initial Access | Medium — legitimate manual installations or reinstalls could trigger; correlate with IT deployment records |
| Consider hunting for modifications to the local hosts file that resolve known EDR management URLs to 127.0.0.1 or other internal addresses, which would block agent telemetry while maintaining a false secure state. | Sysmon Event ID 11 (File Creation) or Event ID 2 (File Change) targeting C:\Windows\System32\drivers\etc\hosts, file integrity monitoring | Defense Evasion | Low — hosts file modifications are rare in enterprise environments and should be investigated |
| Consider hunting for remote thread creation (NtCreateThreadEx) targeting PPL-protected processes such as MsMpEng.exe or SentinelAgent.exe, which would indicate code injection into protected processes. | Sysmon Event ID 8 (Remote Thread Creation), EDR thread injection telemetry | Execution | Low — legitimate remote thread creation into PPL processes is extremely rare |
Control Gaps
- EDR solutions cannot inspect activity within their own PPL-protected processes, creating a blind spot
- COM interface abuse by local administrators is not typically monitored or alerted on
- MSI installer validation logic that accepts localhost URLs provides no meaningful installation authorization
- Local DNS manipulation (hosts file) is not commonly monitored for EDR management URL redirection
- sentinelctl.exe unprotect command execution is not typically alerted on as a security event
Key Behavioral Indicators
- PowerShell process instantiating SentinelHelper.1 COM object outside of SentinelOne's installation directory
- sentinelctl.exe invoked with 'unprotect' argument from non-SentinelOne service context
- Process dump files (.dmp) created in unexpected locations by PowerShell or SentinelOne diagnostic scripts
- Temporary DLL created and deleted by msiexec.exe during SentinelOne installation (site token validation DLL)
- Remote thread creation into MsMpEng.exe or SentinelAgent.exe from non-Microsoft/SentinelOne processes
- New SentinelOne agent installation without corresponding management console deployment record
- Hosts file entries resolving known SentinelOne management URLs to loopback addresses
False Positive Assessment
Low — The specific techniques described (COM object Dump method abuse, sentinelctl.exe unprotect, rogue MSI installation with fake site tokens, hosts file manipulation of management URLs) are highly anomalous in normal enterprise operations. However, legitimate SentinelOne diagnostic activities may produce similar telemetry patterns, requiring contextual correlation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating SentinelOne agents to version 26.1.1 or later, which fixes the COM interface and installer validation vulnerabilities described.
- Consider auditing all endpoints for SentinelOne agent versions below 26.1.1 and prioritizing updates for systems with local administrator accounts.
- Consider reviewing recent MSI installation logs for any unauthorized SentinelOne agent installations, particularly those not initiated through your management console.
Infrastructure Hardening
- Consider restricting local administrator privileges on endpoints to reduce the attack surface for BYOEDR techniques, as all described attacks require local admin access.
- Evaluate whether your EDR management URL can be pinned via DNS resolution controls or network-level allowlisting rather than relying on local host file configuration.
- Consider implementing file integrity monitoring on the Windows hosts file to detect modifications that redirect EDR management URLs.
- If your organization uses application allowlisting, consider restricting which processes can instantiate SentinelOne COM objects.
User Protection
- Consider deploying application control policies that prevent execution of sentinelctl.exe outside of trusted update and management workflows.
- Evaluate whether your EDR solution supports tamper protection for its own COM interface registrations to prevent unauthorized instantiation.
- Consider monitoring for and alerting on any process dump file creation (.dmp) associated with PPL-protected processes.
Security Awareness
- Consider incorporating awareness of BYOEDR techniques into existing security team training, emphasizing that security software itself can be weaponized when local trust assumptions are not hardened.
- Consider educating IT staff that SentinelOne MSI installers should only be deployed through official management channels, not from locally obtained copies.
- If applicable to your awareness program, consider highlighting that a 'SECURE' status displayed by an EDR agent does not guarantee the agent is properly licensed or communicating with its management server.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Additional IOCs
- File Paths:
C:\Windows\Temp\- Temporary directory where MSI installer creates and deletes a random DLL for site token validation
- Command Lines:
- Purpose: Enumerate exposed COM objects on the system | Tools:
PowerShell,gwmi| Stage: Reconnaissance |gwmi Win32_COMSetting | ? {$_.progid} | sort | ft ProgId,Caption,InprocServer32 - Purpose: Instantiate SentinelHelper COM object and enumerate its methods | Tools:
PowerShell| Stage: Reconnaissance |New-Object -ComObject SentinelHelper.1 - Purpose: Dump a protected process via SentinelHelper COM interface | Tools:
PowerShell,SentinelHelper.1 COM object| Stage: Credential Access / Defense Evasion |$SentinelHelper.dump(<pid>, <dump_path>, <kernel_dump_path>) - Purpose: Disable SentinelOne tamper protection to place malware in installation directory | Tools:
sentinelctl.exe| Stage: Defense Evasion |sentinelctl.exe unprotect - Purpose: Re-enable SentinelOne tamper protection to shield malware from removal | Tools:
sentinelctl.exe| Stage: Persistence / Defense Evasion |sentinelctl.exe protect
- Purpose: Enumerate exposed COM objects on the system | Tools:
- Other:
SentinelHelper.1- COM ProgID exposing the Dump method that allows admin-level process dumping of PPL-protected processesSentinelAgent.1- COM ProgID exposed by SentinelOne agent processSentinelUI.1- COM ProgID exposed by SentinelOne UI process{0420773b-38c3-4300-ad2b-23652feee26c}- CLSID of the SentinelHelper COM object exposing methods including Dump, UnprotectPPL, SetProtectionStateewogICJ1cmwiOiAiaHR0cDovLzEyNy4wLjAuMC4xOjg4ODgvIiwKICAic2l0ZV9rZXkiOiAiYWJjMTIzeHl6Igp9- Base64-encoded crafted JSON site token used to bypass SentinelOne installer validation with fake url and site_key fields
