Skip to content
Threat Feed
Subscribe
medium advisory

SentinelOne: Context menu scan command registry modification

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Sources
2 public sources
Freshness
Revision 1Nov 3, 03:39 UTC
Detection
1 rule
Source quality
A2Roughly even chance

The SentinelOne context menu scan command can be tampered with by unauthorized processes. By modifying the Windows registry keys associated with the SentinelOne shell context menu, a process other than SentinelOne may alter the command executed when the scan action is triggered.

Recommendation

  • Monitor for unauthorized modifications to the SentinelOne context menu registry keys using the provided detection logic.
  • Investigate any processes, other than authorized Sentinel Agent binaries, that write to the registry subkeys under '\shell\SentinelOneScan\command'.

Detection coverage 1

Detect Potential SentinelOne Shell Context Menu Tampering

medium

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

sigma tactics: persistence sources: registry_set, windows

Detection queries are available on the platform. Get full rules →