Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process
Alerts on registry modifications to SentinelOne scan context menu command entries not matching SentinelOne’s expected binary.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-03-06
- Updated
- 2026-07-30
What it detects
This rule flags registry updates to the SentinelOne Scan context menu command path when the recorded command details do not correspond to the SentinelOne default scan binary location. Attackers can persist or hijack context menu behavior by modifying these command entries so the next user action runs attacker-controlled code. It relies on Windows registry set telemetry capturing changes under the SentinelOne scan command registry path and the writing process details (image path and command details).
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process"
id: 7b1295a1-11f4-4ce6-baa1-57999c301f7a
status: test
description: This rule flags registry updates to the SentinelOne Scan context menu command path when the recorded command details do not correspond to the SentinelOne default scan binary location. Attackers can persist or hijack context menu behavior by modifying these command entries so the next user action runs attacker-controlled code. It relies on Windows registry set telemetry capturing changes under the SentinelOne scan command registry path and the writing process details (image path and command details).
references:
- https://mrd0x.com/sentinelone-persistence-via-menu-context/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-06
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \shell\SentinelOneScan\command\
filter_main_sentinelone_default_scan_binary:
Details|startswith:
- C:\Program Files\SentinelOne\Sentinel Agent
- C:\Program Files (x86)\SentinelOne\Sentinel Agent
Details|contains: \SentinelScanFromContextMenu.exe
filter_main_sentinelone_binary:
Image|endswith:
- C:\Program Files\SentinelOne\
- C:\Program Files (x86)\SentinelOne\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6c304b02-06e6-402d-8be4-d5833cdf8198
type: derived