A newly discovered "Bring Your Own EDR" attack turns a legitimate SentinelOne endpoint agent into a privileged Trojan horse on Windows. This technique exploits exposed administrative interfaces and trust relationships within the EDR stack to access Protected Process Light (PPL) processes and execute unsigned code without kernel exploitation or vulnerable drivers, as documented by Akamai at DEF CON 34. The findings reveal a concerning vulnerability for defenders: endpoint security tools operate with exceptional privilege, making insecure local interfaces and weak installation assumptions unusually high-impact attack surfaces.
This operation requires local administrator privileges but runs within SentinelOne’s protected context, allowing an administrator to dump processes safeguarded by PPL, including SentinelOne components and Microsoft Defender's MsMpEng.exe.
This distinction is significant: administrative access is already concerning, but PPL aims to continue protecting critical security processes even against various forms of local tampering. Later versions reportedly required local hosting for specific status API requests, highlighting installation and enrollment logic as part of the endpoint attack surface. Additionally, organizations should: - Restrict local administrator privileges - Monitor privileged account usage closely - Audit EDR installer executions - Watch out for unauthorized agent enrollment attempts - Keep an eye on modifications in security-product installation directories Secure EDR self-protection and local management interfaces by hardening them and continuously validating their access points.
