synoti logosynoti logo
Antivirus SentinelOne

Detection rules for SentinelOne Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 19 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Custom Detection Rule TriggersExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
Deep Visibility Threat IndicatorsDefense EvasionT1070 - Indicator Removal on HostC:3 / I:3 / A:2
Kernel-Level Threat DetectionPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:3
Memory Injection DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne AI-Based Threat Hunting AlertsDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne Agent Tampering AttemptsDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
SentinelOne Behavioral Threat DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
SentinelOne Cloud Workload Protection AlertDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:3 / A:2
SentinelOne Container Security AlertDefense Evasion, ExecutionT1610 - Deploy ContainerC:3 / I:3 / A:2
SentinelOne Endpoint Detection and Response (EDR) AlertsExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
SentinelOne IoT Device Compromise IndicatorExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2
SentinelOne Policy Downgraded from Protect to DetectDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
SentinelOne Rollback Operation Patterns DetectionImpactT1490 - Inhibit System RecoveryC:2 / I:3 / A:3
SentinelOne Suspicious Exclusion AdditionDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
SentinelOne Suspicious Script Execution DetectedExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
SentinelOne Threat Mitigation FailuresDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:2
Storyline Correlation EventAttack Chain DetectionAttack Chain AnalysisC:3 / I:3 / A:2
Suspicious Process Tree AnalysisDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:1
Threat Intelligence MatchesExecutionT1203 - Exploitation for Client ExecutionC:2 / I:2 / A:2

Rule Example

Below is an example of a rule definition for Custom Detection Rule Triggers (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-sentinel-one
name: Custom Detection Rule Triggers
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Execution
technique: "T1059 - Command and Scripting Interpreter"
adversary: origin
references:
  - https://docs.sentinelone.com/
  - https://attack.mitre.org/techniques/T1059/
description: |
  Detects when custom detection rules configured in SentinelOne trigger, indicating organization-specific threat patterns or policy violations have been identified. Custom rules are tailored to detect specific behaviors or patterns unique to the organization's security requirements.
  
  Next Steps:
  1. Review the specific custom rule that triggered and understand its purpose
  2. Investigate the affected endpoint (log.syslogHost) for additional suspicious activity
  3. Check if the same custom rule has triggered on other endpoints
  4. Verify if the detection is a false positive based on the custom rule's logic
  5. If legitimate threat activity, initiate incident response procedures
  6. Consider updating the custom rule if false positives are frequent
where: |
  (contains("log.eventDescription", ["custom rule", "custom detection", "Custom Rules"]) ||
   equals("log.detectionSource", "CustomRule") ||
   equals("log.ruleType", "Custom")) &&
  exists("log.syslogHost")
groupBy:
  - lastEvent.log.eventDescription
  - lastEvent.log.syslogHost

Rule Details

Custom Detection Rule Triggers

Detects triggers from custom detection rules set up in SentinelOne, signaling that organization-specific threat patterns or policy violations have been found. These custom rules are designed to catch behaviors or patterns tailored to the organization's unique security needs.

Deep Visibility Threat Indicators

Detects advanced threat indicators via SentinelOne's deep visibility monitoring. This rule fires when specific threat-related events appear in the SentinelOne logs.

Kernel-Level Threat Detection

Detects kernel-level threats such as rootkits, kernel exploits, driver manipulation, and other low-level system attacks aimed at compromising the operating system kernel.

Memory Injection Detection

Detects memory injection attempts, including DLL injection, process hollowing, reflective DLL injection, and other in-memory attack techniques identified by SentinelOne.

SentinelOne AI-Based Threat Hunting Alerts

Detects threats uncovered by SentinelOne's AI and machine learning threat hunting, such as zero-day exploits, fileless attacks, and never-before-seen malware variants.

SentinelOne Agent Tampering Attempts

Identifies attempts to modify, deactivate, or interfere with the SentinelOne agent. Since threat actors often turn off security defenses before carrying out their primary attack, this is a critical security event. A prompt response is necessary.

SentinelOne Behavioral Threat Detection

Detects behavioral threat patterns recognized by SentinelOne's AI engine, such as suspicious process behavior, anomalous system calls, and departures from normal endpoint activity patterns.

SentinelOne Cloud Workload Protection Alert

Detects cloud workload protection alerts, such as suspicious cloud API calls, unauthorized cloud resource access, cloud account compromise, or cloud-native threat detection.

SentinelOne Container Security Alert

Detects container-related security events, such as container drift, unauthorized container deployment, cryptominers in containers, or suspicious container behavior.

SentinelOne Endpoint Detection and Response (EDR) Alerts

Critical EDR alerts from SentinelOne, including suspicious endpoint activities, unauthorized system changes, malicious command execution, and advanced persistent threat (APT) indicators. These alerts point to potential security incidents that demand immediate investigation.

SentinelOne IoT Device Compromise Indicator

Detects signs of IoT device compromise, including unauthorized firmware modifications, suspicious network behavior from IoT devices, or anomalous IoT device activity patterns found by SentinelOne's Singularity Ranger. This rule fires when IoT-related threats are identified, including compromised embedded systems, firmware backdoors, industrial control system attacks, or SCADA system compromises.

SentinelOne Policy Downgraded from Protect to Detect

Detects when a SentinelOne policy is downgraded from Protect mode to Detect-only mode, which halts automatic threat remediation. This is a critical defense evasion indicator because attackers with console access weaken protection before deploying malware.

SentinelOne Rollback Operation Patterns Detection

Detects rollback operations in SentinelOne that may signal ransomware recovery attempts or suspicious rollback activity. Rollback operations are critical system recovery events that should be monitored for legitimate recovery as well as potential abuse.

SentinelOne Suspicious Exclusion Addition

Detects suspicious additions to SentinelOne exclusion or allowlist entries, which attackers abuse to keep their malware or tools from being detected after gaining console access.

SentinelOne Suspicious Script Execution Detected

Detects suspicious script execution activities, including PowerShell, Python, Bash, or other scripting interpreters that may indicate malicious activity or fileless attacks. SentinelOne's behavioral detection engine flags these patterns as potential threats that could compromise system integrity.

SentinelOne Threat Mitigation Failures

Identifies unsuccessful threat mitigation actions in SentinelOne, potentially indicating sophisticated malware that avoids remediation, a compromised system that blocks cleanup, or configuration problems. Unsuccessful mitigations demand immediate investigation.

Storyline Correlation Event

Detects correlated attack patterns found by SentinelOne's Storyline feature, which links related events to expose complete attack chains and multi-stage threats.

Suspicious Process Tree Analysis

Detects suspicious process tree patterns recognized by SentinelOne, such as unusual parent-child relationships, process hollowing, and malicious process chains commonly used in attacks.

Threat Intelligence Matches

Detects matches against threat intelligence feeds, including known malicious hashes, IPs, domains, and behavioral patterns tied to APT groups and cybercrime campaigns. This indicates that SentinelOne has found a file, behavior, or network connection that matches known threat indicators.