Sentinelone - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/sentinelone/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 03:39:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSentinelOne: Context menu scan command registry modificationhttps://feed.craftedsignal.io/briefs/2026-11-sentinelone-registry-tampering/Tue, 03 Nov 2026 03:39:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sentinelone-registry-tampering/Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.The SentinelOne context menu scan command can be tampered with by unauthorized processes. By modifying the Windows registry keys associated with the SentinelOne shell context menu, a process other than SentinelOne may alter the command executed when the scan action is triggered.

Recommendation

  • Monitor for unauthorized modifications to the SentinelOne context menu registry keys using the provided detection logic.
  • Investigate any processes, other than authorized Sentinel Agent binaries, that write to the registry subkeys under '\shell\SentinelOneScan\command'.
]]>mediumadvisorypersistenceregistrywindowssentinelone