Bypass Record
Disable or Modify Tools × SentinelOne EDR
A publicly-reported instance of Disable or Modify Tools bypassing SentinelOne EDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Attackers used the legitimate SentinelOne uninstaller (likely with stolen credentials or elevated privileges) to remove the EDR agent from endpoints, defeating detection and response capabilities. This is a form of 'disable or modify tools' via abuse of a trusted vendor utility, not a vulnerability in the product itself.
Detection & mitigation
Monitor for execution of SentinelOne uninstaller processes (e.g., SentinelCleaner.exe) and correlate with EDR agent status changes. Alert on unexpected uninstall attempts, especially from non-admin accounts or during off-hours, and enforce application control to block uninstaller execution without approval.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.