Critical SentinelOne Vulnerability (CVE-2023-5149) Lets Attackers Hide Malware

Key Takeaways

• A critical vulnerability, CVE-2023-5149, was discovered in SentinelOne’s Endpoint Detection and Response (EDR) solution.
• The flaw allowed attackers with local administrator privileges to transform the EDR agent into a mechanism for hiding malware and evading detection.
• The attack leveraged trusted SentinelOne components to bypass Windows Protected Process Light (PPL) and the EDR’s own self-protection features.
• SentinelOne addressed the issue in Agent version 26.1.1.

A significant security vulnerability, identified as CVE-2023-5149, has been uncovered in SentinelOne’s EDR platform. This “Bring Your Own EDR” attack method allows malicious actors to manipulate trusted components of the endpoint protection software, effectively turning it into a shield for their malware. The research, which highlights how an EDR solution can be co-opted, was initially presented at DEF CON 34 in Las Vegas. SentinelOne has since released a fix in Agent version 26.1.1.

Endpoint detection and response tools are designed to operate with extensive system privileges and deep visibility into processes, files, memory, and overall system behavior. This elevated access is crucial for their function but can become a significant security risk if local interfaces, installer logic, or trust boundaries are not adequately secured.

The core of this research revolves around Windows Protected Process Light (PPL), a security model within Windows. PPL aims to prevent unauthorized processes from reading, modifying, debugging, or terminating critical security services. Antivirus and EDR products typically utilize the Antimalware-Light protection level, similar to how essential services like LSASS and Windows Defender components are protected.

Bring Your Own EDR Attack

Exploiting SentinelOne’s COM Interfaces

Akamai researchers observed that SentinelOne exposed several Component Object Model (COM) interfaces, including a specific “SentinelHelper” object. One method within this object, named “Dump,” could be invoked by a local administrator to create memory dumps of processes protected by PPL.

Crucially, this “Dump” method reportedly lacked stringent validation regarding the calling application’s location. This oversight provided an attacker with local administrator privileges a pathway to dump the memory of PPL-protected processes, including the SentinelOne agent itself and Microsoft Defender. This technique bypassed the need for a vulnerable driver, kernel exploit, or traditional Windows privilege escalation. Instead, it leveraged a legitimate, trusted EDR process to execute actions typically restricted to user-mode software.

The researchers further developed this capability by combining it with previous COM-based PPL research. By extracting process-specific COM secrets from the memory dumps, they demonstrated a method for mapping and executing unsigned code within another PPL-protected process. Their proof-of-concept ultimately enabled the execution of an unsigned payload within the protected context of Microsoft Defender, after overcoming memory permissions, relocations, and dependency-loading constraints.

Installer Abuse and Evasion Tactics

Beyond memory dumping, the research also scrutinized SentinelOne’s installer behavior. It was found that a legitimate installer could be configured with a specially crafted registration value to deploy a non-functional local agent. Such an agent could still report a “secure” status to the management console while simultaneously disabling competing endpoint protections. This transforms a trusted product installer into a potential tool for weakening a target’s overall defensive posture.

Another area of concern involved management connectivity. The researchers noted that the agent’s management URL could be identified via an accessible status interface. By locally redirecting this hostname, an attacker could prevent cloud telemetry from being sent, making the endpoint agent appear active and healthy while inhibiting the detection of an attack from the central management console.

The most severe implication of this vulnerability is the ability to reverse an EDR product’s self-protection features. An attacker could place a malicious payload within the EDR installation directory, re-enable tamper protection, and then leverage SentinelOne’s own mechanisms to block other processes from modifying or accessing the malware. This would allow the malicious payload to evade both Windows PPL protections and the EDR’s file- and process-based defense mechanisms, underscoring the necessity of treating endpoint protection as high-value infrastructure.

The vulnerability was promptly reported to SentinelOne and has been addressed in Agent version 26.1.1 and later.

What You Should Do

• Update SentinelOne Agents: Immediately update all SentinelOne agents to version 26.1.1 or a later release to patch this vulnerability.
• Restrict Local Administrator Rights: Tightly restrict local administrator rights on endpoints. This vulnerability specifically requires administrator privileges to exploit.
• Monitor Installer Activity: Implement robust monitoring for any unexpected or suspicious installer activity related to EDR solutions.
• Investigate DNS/Hosts File Changes: Regularly audit and investigate any unauthorized changes to local DNS or hosts file entries that could affect EDR management domains.
• Review EDR Management Interfaces: Security teams should review whether their EDR platform exposes local management interfaces that administrators can access without strong authorization controls.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.