Labs

CVE 2021 24092  Uncovering A 12 Year Old Privilege Escalation Vulnerability In A Windows Defender Driver 6

CVE-2021-24092: 12 Years in Hiding – A Privilege Escalation Vulnerability in Windows Defender

Windows Defender has contained an elevation of privilege vulnerability since at least 2009. Learn more about SentinelOne’s discovery, CVE-2021-24092, here.

Read More
Zeoticus 2.0   Ransomware With No C2 Required 4

Zeoticus 2.0 | Ransomware With No C2 Required

Zeoticus is a Windows-specific ransomware that can execute fully offline with no callback to a C2, making network activity detection rules redundant.

Read More
FADE DEAD   Adventures In Reversing Malicious Run Only AppleScripts 2

FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts

We show how to statically reverse run-only AppleScripts for the first time, and in the process reveal new IoCs of a long-running macOS Cryptominer campaign.

Read More
Greywares Anatomy  The Potentially Unwanted Are Upping Their Game 1

Greyware’s Anatomy: The “Potentially Unwanted” are Upping Their Game

Adware infections may appear unremarkable at first, but in this example incident analysis we demonstrate their growing sophistication and risk.

Read More
Building A Custom Malware Analysis Lab Environment 2

Building a Custom Malware Analysis Lab Environment

Building the right malware analysis environment is the first step for every researcher. We show how it’s done and offer some free custom tools for your use.

Read More
SolarWinds   Understanding Detecting The SUPERNOVA Webshell Trojan 3

SolarWinds | Understanding & Detecting the SUPERNOVA Webshell Trojan

Our analysis of the SUPERNOVA trojan reveals the differences between the legitimate DLL and the attacker’s implant, along with some new IoCs for detection.

Read More
SolarWinds SunBurst Backdoor  Inside The Stealthy APT Campaign 1

SolarWinds SUNBURST Backdoor: Inside the APT Campaign

A technical analysis of the SUNBURST stealthy APT including processes, services, and drivers. SentinelOne customers protected with no updates or configuration changes.

Read More
DataPlatform Hero 1600x900

Our CVEs

Explore the world of enterprise software vulnerabilities discovered by our leading researchers

Read More
Introducing SentinelOnes Ghidra SRE Plugin For VirusTotal 4

Introducing SentinelOne’s Ghidra Plugin for VirusTotal

Ghidra users can now enjoy the same (and more!) benefits available in IDA Pro from VirusTotal’s VTGrep plugin with this open source plugin from SentinelLabs.

Read More
APT32 Multi Stage MacOS Trojan Innovates On Crimeware Scripting Technique 7

APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique

Vietnamese-linked APT group OceanLotus have innovated and imitated in their latest macOS trojan, while also leaving a mysterious hard-coded calling card.

Read More