Potential SentinelOne Shell Context Menu Scan Command Tampering

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential SentinelOne Shell Context Menu Scan Command Tampering
id: 6c304b02-06e6-402d-8be4-d5833cdf8198
status: test
description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
references:
    - https://mrd0x.com/sentinelone-persistence-via-menu-context/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-03-06
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\shell\SentinelOneScan\command\'
    filter_main_sentinelone_default_scan_binary:
        Details|startswith:
            - 'C:\Program Files\SentinelOne\Sentinel Agent'
            - 'C:\Program Files (x86)\SentinelOne\Sentinel Agent'
        Details|contains: '\SentinelScanFromContextMenu.exe'
    filter_main_sentinelone_binary:
        Image|endswith:
            - 'C:\Program Files\SentinelOne\'
            - 'C:\Program Files (x86)\SentinelOne\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetObject|contains: '\shell\SentinelOneScan\command\'

Stage 2: `not filter_main_*`

filter_main_sentinelone_default_scan_binary:
    Details|startswith:
        - 'C:\Program Files\SentinelOne\Sentinel Agent'
        - 'C:\Program Files (x86)\SentinelOne\Sentinel Agent'
    Details|contains: '\SentinelScanFromContextMenu.exe'
filter_main_sentinelone_binary:
    Image|endswith:
        - 'C:\Program Files\SentinelOne\'
        - 'C:\Program Files (x86)\SentinelOne\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	starts_with	`C:\Program Files (x86)\SentinelOne\Sentinel Agent`	`excludes:Details` `field:"Details" value:"C:\Program Files (x86)\SentinelOne\Sentinel Agent"`
`Details`	starts_with	`C:\Program Files\SentinelOne\Sentinel Agent`	`excludes:Details` `field:"Details" value:"C:\Program Files\SentinelOne\Sentinel Agent"`
`Details`	match	`\SentinelScanFromContextMenu.exe`	`excludes:Details` `field:"Details" value:"\SentinelScanFromContextMenu.exe"`
`Image`	ends_with	`C:\Program Files (x86)\SentinelOne\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\SentinelOne\"`
`Image`	ends_with	`C:\Program Files\SentinelOne\`	`excludes:Image` `field:"Image" value:"C:\Program Files\SentinelOne\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`\shell\SentinelOneScan\command\`	`field:"TargetObject" kind:match value:"\shell\SentinelOneScan\command\"`