Security researchers have introduced a new technique called “Bring Your Own EDR” (BYOEDR) that exploits legitimate SentinelOne components to bypass Windows Protected Process Light (PPL) protections, allowing the execution of unsigned code within highly secured processes.
This research, presented by Akamai at DEF CON 34, demonstrates how trusted endpoint detection and response (EDR) software can be repurposed as an offensive tool due to insufficient hardening of its locally accessible interfaces, installer logic, and self-protection features. SentinelOne addressed the reported issue in Agent version 26.1.1.
Exploiting EDR Privileges
Windows PPL aims to protect critical processes, such as antivirus engines, EDR agents, and LSASS, from memory access, debugging, termination, and the loading of untrusted code.
Security products often use the PsProtectedSignerAntimalware-Light level to create a boundary that prevents attackers from manipulating these processes.
Akamai researchers discovered that SentinelOne’s SentinelHelper COM interface offered a diagnostic Dump method that could create memory dumps of arbitrary processes.
Although this method required local administrator rights, it lacked the caller-path validation present in several other interface methods.
Since the helper service operates as a PPL-protected process, an administrator could exploit this functionality to dump other protected processes without needing a malicious driver, kernel vulnerability, or a traditional exploit chain.
This capability could potentially enable attackers to extract sensitive information from protected processes, which could be used in further attacks.
The researchers built on previous work regarding PPLSystem, which had demonstrated that unsigned modules could be mapped into protected processes but not executed.
Akamai’s research focused on overcoming execution barriers by preparing position-independent payloads, ensuring that the required PE data was mapped, resolving relocation and memory-protection issues, and avoiding dependencies on unsigned runtime libraries.
The proof of concept reportedly achieved unsigned code execution in a PPL context, including within Microsoft Defender’s MsMpEng.exe. This research highlights that PPL protections are only as robust as the privileged components and interfaces that interact with those processes.
The BYOEDR concept extends beyond existing SentinelOne deployments. Akamai noted that a legitimate installer could be manipulated in older versions to deploy a nonfunctional agent using fabricated registration information.
This could effectively turn off competing endpoint products while presenting a misleading “SECURE” status.
Additionally, the researchers found that management communication could be disrupted by redirecting the configured management hostname through a local host-resolution mechanism.
This tactic could isolate the agent from cloud telemetry while maintaining the illusion that endpoint protection is still active.
Defensive Implications
These findings underscore a broader security issue concerning EDRs: since endpoint products have extensive privileges, they create a significant attack surface.
If self-protection mechanisms are exposed to local administrators or paired with weak trust validation, they can inadvertently protect malicious files and processes rather than safeguard the endpoint.
Organizations should promptly update SentinelOne agents to version 26.1.1 or later, investigate any unauthorized local administrator activity, monitor for unexpected EDR installations or agent state changes, and alert on modified host-resolution settings that affect EDR management domains.
Additionally, security teams should verify that endpoint agents are actively reporting to their management consoles rather than relying solely on local “healthy” status indicators.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
