A reverse-engineering teardown of SentinelOne Agent 26.1.2.177. The alarming part isn’t any single detection rule it’s how little skill, and how little time, it took to pull the whole detection stack apart on a workbench.
#Edr
SE Sec Note @secnote · 2.88K subscribers A reverse-engineering teardown of SentinelOne Agent 26.1.2.177. The alarming part isn’t any single detection rule it’s how little skill, and how little time, it took to pull the whole detection stack apart on a workbench.