A “Bring Your Own EDR” attack abuses trusted SentinelOne components to turn endpoint protection into a powerful malware shield. The research was presented at DEF CON 34 in Las Vegas, and SentinelOne fixed the reported issue in Agent version 26.1.1.
Endpoint detection and response tools operate with deep visibility and high privileges because they must inspect processes, files, memory, and system behavior.
Those same privileges can become dangerous when local interfaces, installer logic, and trust boundaries are not sufficiently protected.
The research focuses on Windows Protected Process Light, or PPL. This Windows security model is intended to prevent ordinary processes from reading, modifying, debugging, or terminating protected security services.
Antivirus and EDR products commonly use the Antimalware-Light protection level. At the same time, other protected services include LSASS and Windows Defender components.
Bring Your Own EDR Attack
Akamai researchers found that SentinelOne exposed several Component Object Model interfaces, including a SentinelHelper object. One method, called Dump, can be invoked by a local administrator to create memory dumps of protected processes.
Unlike other exposed functions, the method reportedly lacked strict validation of the calling application’s location. This gave an administrator-level attacker a way to dump processes protected by PPL, including SentinelOne’s own agent and Microsoft Defender.
Attack on SentinelOne (Source: Akamai)
The technique did not require a vulnerable driver, a kernel exploit, or a traditional Windows privilege-escalation vulnerability. Instead, it abused a legitimate, trusted EDR process to perform actions that normal user-mode software cannot.
The researchers then chained this capability with earlier COM-based PPL research. By extracting process-specific COM secrets from dumped memory, they demonstrated a path for mapping and executing unsigned code within another PPL-protected process.
In their testing, the attack ultimately enabled execution of an unsigned payload in the protected context of Microsoft Defender after addressing memory permissions, relocations, and dependency-loading restrictions.
The research also examined SentinelOne installer behavior. A legitimate installer could allegedly be configured with a crafted registration value to deploy a nonfunctional local agent.
Attack Flaw (Source: Akamai)
Such an agent could still report a “secure” status while turning off competing endpoint protections. This transforms a trusted product installer into a possible tool for weakening a target’s defensive posture.
Another concern involves management connectivity. The Akamai researchers observed that the agent’s management URL could be identified through an accessible status interface.
Redirecting that hostname locally could prevent cloud telemetry from being collected while leaving the endpoint agent appearing active. This could delay detection of an attack from the management console.
The most serious impact comes from reversing an EDR product’s self-protection features. An attacker could place a malicious payload in the EDR installation directory, re-enable tamper protection, and let SentinelOne block other processes from modifying or accessing the malware.
The malicious payload could evade both Windows PPL protections and the EDR’s own file- and process-based defense mechanisms. The findings show that endpoint protection must be treated as high-value infrastructure.
The vulnerability was reported and fixed in SentinelOne version 26.1.1 or later. Organizations should update SentinelOne agents to tightly restrict local administrator rights, monitor for unexpected installer activity, and investigate changes to local DNS or hosts file entries that affect EDR management domains.
Security teams should also review whether their EDR platform exposes local management interfaces that administrators can access without strong authorization controls.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Bring Your Own EDR Attack Turns SentinelOne Into PPL-Protected Trojan Horse to Shield Malware appeared first on Cyber Security News.
