Index / Tamper-Protection Bypass / SentinelOne
Bypass Record

Tamper-Protection Bypass × SentinelOne EDR agent

A publicly-reported instance of Tamper-Protection Bypass bypassing SentinelOne EDR agent, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
SentinelOne EDR agent
Technique
Tamper-Protection Bypass
MITRE ATT&CK
T1562.001
Confidence
High
Severity
High
Status
in the wild
Disclosed
2025-05-05
Config / version noted
Not stated

Provenance

Reported as

attackers run a legitimate SentinelOne installer, which terminates running agent processes... then forcefully kill the installer process after agent shutdown but before the new agent starts

Mechanism

Attackers with administrative access run a legitimate SentinelOne installer, which terminates running agent processes before installing the new version. They then forcefully kill the installer process after agent shutdown but before the new agent starts, leaving the endpoint unprotected.

Detection & mitigation

Monitor for unexpected termination of EDR agent processes (e.g., SentinelOne) immediately following execution of a legitimate installer binary, especially when the installer process is killed before completion. Enable EDR tamper protection features such as SentinelOne's Online Authorization to require cloud validation before allowing agent shutdown.

Tamper-Protection Bypass has also been recorded against

AppSealingArxanBeyondTrustBroadcom (Symantec)ByfronCrowdStrikeDANAElasticFireEyeKemcoLoGiC.NETMcAfee

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.