UTMSTACK logoUTMSTACK logo
Antivirus SentinelOne

Detection rules for SentinelOne data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 19 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Custom Detection Rule TriggersExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
Deep Visibility Threat IndicatorsDefense EvasionT1070 - Indicator Removal on HostC:3 / I:3 / A:2
Kernel-Level Threat DetectionPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:3
Memory Injection DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne AI-Based Threat Hunting AlertsDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne Agent Tampering AttemptsDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
SentinelOne Behavioral Threat DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne Cloud Workload Protection AlertDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:3 / A:2
SentinelOne Container Security AlertDefense Evasion, ExecutionT1610 - Deploy ContainerC:3 / I:3 / A:2
SentinelOne Endpoint Detection and Response (EDR) AlertsExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
SentinelOne IoT Device Compromise IndicatorExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2
SentinelOne Policy Downgraded from Protect to DetectDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
SentinelOne Rollback Operation Patterns DetectionImpactT1490 - Inhibit System RecoveryC:2 / I:3 / A:3
SentinelOne Suspicious Exclusion AdditionDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
SentinelOne Suspicious Script Execution DetectedExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
SentinelOne Threat Mitigation FailuresDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:2
Storyline Correlation EventAttack Chain DetectionAttack Chain AnalysisC:3 / I:3 / A:2
Suspicious Process Tree AnalysisDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:1
Threat Intelligence MatchesExecutionT1203 - Exploitation for Client ExecutionC:2 / I:2 / A:2

Rule Example

Below is an example of a rule definition for Custom Detection Rule Triggers (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-sentinel-one
name: Custom Detection Rule Triggers
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Execution
technique: "T1059 - Command and Scripting Interpreter"
adversary: origin
references:
  - https://docs.sentinelone.com/
  - https://attack.mitre.org/techniques/T1059/
description: |
  Detects when custom detection rules configured in SentinelOne trigger, indicating organization-specific threat patterns or policy violations have been identified. Custom rules are tailored to detect specific behaviors or patterns unique to the organization's security requirements.
  
  Next Steps:
  1. Review the specific custom rule that triggered and understand its purpose
  2. Investigate the affected endpoint (log.syslogHost) for additional suspicious activity
  3. Check if the same custom rule has triggered on other endpoints
  4. Verify if the detection is a false positive based on the custom rule's logic
  5. If legitimate threat activity, initiate incident response procedures
  6. Consider updating the custom rule if false positives are frequent
where: |
  (contains("log.eventDescription", ["custom rule", "custom detection", "Custom Rules"]) ||
   equals("log.detectionSource", "CustomRule") ||
   equals("log.ruleType", "Custom")) &&
  exists("log.syslogHost")
groupBy:
  - lastEvent.log.eventDescription
  - lastEvent.log.syslogHost

Rule Details

Custom Detection Rule Triggers

Detects when custom detection rules configured in SentinelOne trigger, indicating organization-specific threat patterns or policy violations have been identified. Custom rules are tailored to detect specific behaviors or patterns unique to the organization's security requirements.

Deep Visibility Threat Indicators

Detects advanced threat indicators through SentinelOne's deep visibility monitoring. This rule triggers when specific threat-related events are detected in the SentinelOne logs.

Kernel-Level Threat Detection

Detects kernel-level threats including rootkits, kernel exploits, driver manipulation, and other low-level system attacks that attempt to compromise the operating system kernel.

Memory Injection Detection

Detects memory injection attempts including DLL injection, process hollowing, reflective DLL injection, and other in-memory attack techniques detected by SentinelOne.

SentinelOne AI-Based Threat Hunting Alerts

Detects threats identified by SentinelOne's AI and machine learning threat hunting capabilities, including zero-day exploits, fileless attacks, and previously unknown malware variants.

SentinelOne Agent Tampering Attempts

Detects attempts to tamper with, disable, or modify the SentinelOne agent. This is a critical security event as attackers often try to disable security tools before launching their main attack. Immediate response required.

SentinelOne Behavioral Threat Detection

Detects behavioral threat patterns identified by SentinelOne's AI engine, including suspicious process behaviors, anomalous system calls, and deviations from normal endpoint activity patterns.

SentinelOne Cloud Workload Protection Alert

Detects cloud workload protection alerts including suspicious cloud API calls, unauthorized cloud resource access, cloud account compromise, or cloud-native threat detection.

SentinelOne Container Security Alert

Detects container-related security events including container drift, unauthorized container deployment, cryptominers in containers, or suspicious container behavior.

SentinelOne Endpoint Detection and Response (EDR) Alerts

Critical EDR alerts from SentinelOne including suspicious endpoint activities, unauthorized system changes, malicious command execution, and advanced persistent threat (APT) indicators. These alerts indicate potential security incidents that require immediate investigation.

SentinelOne IoT Device Compromise Indicator

Detects indicators of IoT device compromise including unauthorized firmware modifications, suspicious network behavior from IoT devices, or anomalous IoT device activity patterns detected by SentinelOne's Singularity Ranger. This rule triggers when IoT-related threats are identified including compromised embedded systems, firmware backdoors, industrial control system attacks, or SCADA system compromises.

SentinelOne Policy Downgraded from Protect to Detect

Detects when a SentinelOne policy is downgraded from Protect mode to Detect-only mode, which stops automatic threat remediation. This is a critical defense evasion indicator as attackers with console access weaken protection before deploying malware.

SentinelOne Rollback Operation Patterns Detection

Detects rollback operations in SentinelOne that may indicate ransomware recovery attempts or suspicious rollback activity. Rollback operations are critical system recovery events that should be monitored for both legitimate recovery and potential abuse scenarios.

SentinelOne Suspicious Exclusion Addition

Detects suspicious additions to SentinelOne exclusion or allowlist entries, which attackers abuse to prevent detection of their malware or tools after gaining console access.

SentinelOne Suspicious Script Execution Detected

Detects suspicious script execution activities including PowerShell, Python, Bash, or other scripting interpreters that may indicate malicious activity or fileless attacks. SentinelOne's behavioral detection engine identifies these patterns as potential threats that could compromise system integrity.

SentinelOne Threat Mitigation Failures

Detects failed threat mitigation attempts in SentinelOne, which could indicate advanced malware evading remediation, system compromise preventing cleanup, or configuration issues. Failed mitigations require immediate investigation.

Storyline Correlation Event

Detects correlated attack patterns identified by SentinelOne's Storyline feature, which connects related events to reveal complete attack chains and multi-stage threats.

Suspicious Process Tree Analysis

Detects suspicious process tree patterns identified by SentinelOne, including unusual parent-child relationships, process hollowing, and malicious process chains commonly used in attacks.

Threat Intelligence Matches

Detects matches against threat intelligence feeds including known malicious hashes, IPs, domains, and behavioral patterns associated with APT groups and cybercrime campaigns. This indicates that SentinelOne has identified a file, behavior, or network connection that matches known threat indicators.