Blog post updated for further clarity.
A research team at SentinelOne’s partner, Aon (Stroz Friedberg) published research this week that discussed a local bypass technique that had the potential to impact SentinelOne’s Windows agent. These researchers first contacted SentinelOne in mid-January 2025 to share the issue. Upon being contacted by Stroz’s researchers, we immediately issued an update that made it even easier to prevent against such techniques and communicated guidance (Note: This is a password-protected site for SentinelOne customers only) to all of our customers regarding the new Local Upgrade Authorization toggle switch and how to use it to protect against this type of local bypass attempt. As Stroz themselves have reported, the technique described in the research requires an attacker to have a local administrator account on the machine they’re attempting to compromise and access to a SentinelOne-signed installer. Stroz’s researchers tested SentinelOne’s new local upgrade feature and noted its effectiveness in their blog, stating, “Stroz Friedberg performed preliminary testing surrounding this feature and was unable to perform the EDR bypass as previously described above once this option was enabled.”
SentinelOne also shared Stroz’s research with prominent EDR vendors, as the technique is one that could be applied against other endpoint protection products. While such local access poses similar threats to anti-tampering for these EDR products, at large, Stroz went on to say that they have no “knowledge of any EDR vendor, including SentinelOne, that is currently impacted by this attack when their product is properly configured.”
It’s important to note a few additional points that were not fully covered in Stroz’s original blog post.
- We have mitigated unapproved agent upgrades via our Local Upgrade Authorization feature. SentinelOne customers can access information about this feature in the password-protected SentinelOne documentation site here. This feature implements two protection mechanisms when enabled:
- The local agent passphrase is set as required to prevent unauthorized agent upgrades. Regardless of whether the Local Update Authorization feature is enabled, the agent passphrase is automatically required by default for all customers to protect against unauthorized agent installs or uninstalls. Local Update Authorization provides additional protection for agent upgrades.
- Upgrades conducted outside of the SentinelOne console must be approved by a SentinelOne administrator.
- This local upgrade protection configuration is not enabled by default for existing customers to ensure continuity of operations with existing deployment and upgrade workflows, notably in third-party tools, such as System Center Configuration Manager.
Additional steps we’re taking to help customers protect against this technique:
- Today, we are further upgrading these security measures by enabling the Local Update Authorization feature by default for all new customers.
- Additionally, we have updated customer communications reinforcing the guidance sent in January.
We’d like to thank the team at Stroz Friedberg for their partnership in helping to protect customers from this type of technique.
