Bypass Record
DLL Side-Loading × SentinelOne Endpoint Agent
A publicly-reported instance of DLL Side-Loading bypassing SentinelOne Endpoint Agent, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The attack loads a malicious DLL into the SentinelOne agent process, exploiting its high privileges and trusted status to bypass Windows security mechanisms. This is a form of DLL sideloading or process injection that abuses the agent's legitimate code signing and kernel access.
Detection & mitigation
Monitor for unexpected DLL loads into security agent processes (e.g., via Sysmon Event ID 7) and anomalous process behavior. Enforce strict integrity controls on EDR agent binaries and directories, and restrict local admin privileges.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.