A newly demonstrated “Bring Your Own EDR” attack can turn a legitimate SentinelOne endpoint agent into a privileged Trojan horse on Windows.
Documented by Akamai, the technique abuses exposed administrative interfaces and trust relationships within the EDR stack to access Protected Process Light (PPL) processes and to execute unsigned code without a kernel exploit or a vulnerable driver.
Presented at DEF CON 34, the findings highlight a troublesome reality for defenders: endpoint security tools operate with exceptional privilege, making insecure local interfaces and weak installation assumptions unusually high-impact attack surfaces.
Bring Your Own EDR Attack Weaponizes SentinelOne
Akamai said the reported SentinelOne issue was fixed in Agent version 26.1.1. Windows Protected Process Light is designed to stop ordinary processes from reading, modifying, debugging, or terminating security-sensitive processes.
Antivirus and EDR products commonly use the Antimalware-Light signer level, while components such as LSASS rely on related PPL protections.
The research focused on exposed interfaces in the SentinelOne Component Object Model (COM). Shahak Morag identified the SentinelHelper.1 interface and a Dump method that could create process dumps for a supplied process identifier.
While access required local administrator privileges, the operation ran through SentinelOne’s protected context, enabling an administrator to dump processes protected by PPL, including SentinelOne components and Microsoft Defender’s MsMpEng.exe.
That distinction matters: administrative access is already serious, but PPL is intended to continue protecting critical security processes even from many forms of local tampering. The exposed diagnostic capability effectively created a bridge across that boundary.
Akamai chained the dump primitive with prior public PPL research to extract COM-related process secrets from a protected target. The researchers then refined an injection workflow so that code mapped into a PPL process could actually execute, rather than merely reside in memory.
Their work addressed multiple engineering barriers, including memory-protection settings, relocation handling, missing shellcode mapping, and unsigned dependency loading.
By statically compiling the payload and avoiding unsigned runtime DLL dependencies, the researchers reported achieving unsigned code execution in a PPL context such as Microsoft Defender.
The chain did not rely on a malicious kernel driver, a Windows kernel vulnerability, or a conventional memory-corruption exploit. Instead, it combined an administrator-accessible COM interface with privileged EDR execution and Windows trust boundaries.
The research also explored installing a SentinelOne agent with fabricated registration data. Akamai found that installer validation could accept crafted token data under the tested conditions, resulting in an agent that appeared “secure” while lacking functional management connectivity.
Later versions reportedly required a locally hosted endpoint for a specific status API request, but the broader concern remained: installation and enrollment logic can become part of the endpoint attack surface.
Shahak Morag further showed that management communication could be disrupted by redirecting the configured management hostname to localhost through local name resolution.
That would isolate the agent from cloud telemetry while preserving its apparent local operational state, potentially delaying detection of compromise.
Mitigation
Security teams should upgrade SentinelOne agents to version 26.1.1 or later and verify vendor guidance for the environment. Organizations should also:
- Restrict local administrator privileges and closely monitor privileged account use.
- Audit EDR installer execution, unauthorized agent enrollment attempts, and modifications under security-product installation directories.
- Treat EDR self-protection and local management interfaces as privileged assets requiring hardening and continuous validation.
The research is a reminder that trusted security products are not merely defensive controls. When their privileged interfaces, installers, or telemetry paths are insufficiently hardened, they can become an attacker’s most powerful asset.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
