Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process

title: "Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process"
id: 7b1295a1-11f4-4ce6-baa1-57999c301f7a
status: test
description: This rule flags registry updates to the SentinelOne Scan context menu command path when the recorded command details do not correspond to the SentinelOne default scan binary location. Attackers can persist or hijack context menu behavior by modifying these command entries so the next user action runs attacker-controlled code. It relies on Windows registry set telemetry capturing changes under the SentinelOne scan command registry path and the writing process details (image path and command details).
references:
  - https://mrd0x.com/sentinelone-persistence-via-menu-context/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-06
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \shell\SentinelOneScan\command\
  filter_main_sentinelone_default_scan_binary:
    Details|startswith:
      - C:\Program Files\SentinelOne\Sentinel Agent
      - C:\Program Files (x86)\SentinelOne\Sentinel Agent
    Details|contains: \SentinelScanFromContextMenu.exe
  filter_main_sentinelone_binary:
    Image|endswith:
      - C:\Program Files\SentinelOne\
      - C:\Program Files (x86)\SentinelOne\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6c304b02-06e6-402d-8be4-d5833cdf8198
    type: derived