Bring Your Own EDR Attack Turns SentinelOne Into PPL-Protected Trojan Horse to Shield Malware — Threadlinqs Intelligence
As of 2026-08-14, Bring Your Own EDR Attack Turns SentinelOne Into PPL-Protected Trojan Horse to Shield Malware is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 9 indicators of compromise.
Threat ID: TL-2026-2017 · Severity: HIGH · Status: PATCHED · Category: VULNERABILITY
Akamai researcher Shahak Morag disclosed 'Bring Your Own EDR' (BYOEDR) at DEF CON 34: an administrator-level attacker abuses SentinelOne's SentinelHelper COM interface (an unvalidated Dump method),
At DEF CON 34 (Las Vegas, August 7, 2026), Akamai security researcher Shahak Morag presented "Bring-Your-Own-EDR – Breaking Windows Process Protection to build EDR-Protected Malware," published the same day as an Akamai blog post, 'Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse.' The research shows that SentinelOne exposes three local COM objects -- SentinelHelper.1, SentinelUI.1, and SentinelAgent.1. SentinelHelper.1 alone exposes a wide method surface: `Dump(uint processId, string userDumpPath, string kernelDumpPath)`, `GetAgentStatusJSON`, `ApplyConfig`, `GetConfig`, `SetConfig`, `SetProtectionState`, `UnprotectPPL`, `Stop`, `GetDumper`, `GetServiceToken`, and `LiveKernelDump`. Of these, `Dump` -- designed for use by the legitimate DiagnosticsCollector.ps1 script -- is the outlier: unlike SentinelHelper's other methods, it checks only that the caller holds administrator privileges, not the caller's file-system location. That gap lets any local-admin process invoke Dump against Windows Protected Process Light (PPL) targets signed at the `PsProtectedSignerAntimalware-Light` signer level, including SentinelOne's own SentinelAgent.exe and Microsoft Defender's MsMpEng.exe.
The full exploit chain has four phases. First, the attacker dumps a PPL process's memory via SentinelHelper.Dump, using `CoSetProxyBlanket` to configure the COM security/impersonation level needed to make the call succeed. Second, the dump is analyzed in WinDbg to recover process-specific COM secrets -- `combase!CProcessSecret::s_guidOle32Secret` (observed by Akamai as `{6c8844c0-0cd1-7a62-6f72-57d03fe54d6a}` in their proof-of-concept run) and the `g_pMTAEmptyCtx` pointer -- which, combined with the `CStdStubBuffer_AddRef` primitive, grant an arbitrary memory-read/injection primitive inside the PPL address space. This step builds directly on Slowerzs' prior PPLSystem research (github.com/Slowerzs/PPLSystem, blog.slowerzs.net/posts/pplsystem/, May 2024), which had already shown how to extract a PPL process's COM secret and context to remotely invoke `IRundown::DoCallback` inside the process, but stopped short of achieving arbitrary code execution; Akamai's contribution is extending that primitive into full shellcode execution. Third, the attacker reflectively maps an unsigned payload into the protected process using `NtMapViewOfSection`, working around several practical obstacles: the mapped entry page defaults to PAGE_READONLY (fixed via `NtProtectVirtualMemory`, flipping it to PAGE_EXECUTE_READWRITE), the PE-to-shellcode conversion tool (PE_TO_SHELLCODE) places its relocation-fixing code outside the mapped PE sections (worked around with a custom Python script that adds a `.overlay` section as an 8th PE section carrying the relocation shellcode), and relocation requires all sections to be marked RWX (characteristics `0xE0000020`, verified copy-on-write via WinDbg's `!vprot`) so the fixup code can rewrite them before the loader flips permissions back. The payload is statically compiled so it does not pull in unsigned runtime DLLs (e.g., vcruntime140.dll), which PPL rejects. Fourth, `NtCreateThreadEx` starts a thread at the mapped shellcode, achieving unsigned code execution inside the PPL boundary -- effectively subverting the code-signing enforcement PPL exists to guarantee.
Akamai also documented two complementary, non-memory-corruption abuses of SentinelOne's own installer and self-protection logic. The Windows MSI installer's registration flow can be tricked into completing a non-functional install: the installer extracts a temporary validation DLL, calls it, and deletes it, and Akamai used WinDbg plus Process Monitor to intercept that DLL and reverse-engineer the Base64-encoded JSON site-token format it expects (`{"url": "http://127.0.0.1:8888/", "site_key": "abc123xyz"}`), without any real management server; newer versions add a check against a `/api/v1.6/gw-overall-status` HTTP endpoint that a mock loopback server can also satisf
Weaknesses (CWE)
CWE-346, CWE-269, CWE-345
Timeline
- Researcher Slowerzs published PPLSystem, demonstrating extraction of a PPL process's COM secret/context to remotely invoke IRundown::DoCallback inside the process -- the foundational primitive Akamai's BYOEDR research later extended into full unsigned code execution.
- Akamai researchers identified three exposed SentinelOne COM objects (SentinelHelper.1, SentinelUI.1, SentinelAgent.1); SentinelHelper's Dump method was found to lack the caller-path validation enforced on its other methods (ApplyConfig, GetConfig, SetConfig, SetProtectionState, UnprotectPPL, Stop, GetDumper, GetServiceToken, LiveKernelDump).
- Akamai researcher Shahak Morag presented "Bring-Your-Own-EDR – Breaking Windows Process Protection to build EDR-Protected Malware" at DEF CON 34 (LVCC, Las Vegas), publicly demonstrating the full SentinelOne PPL-bypass chain.
- Akamai published the technical write-up "Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse," detailing the SentinelHelper COM abuse, PPL injection chain, and installer/tamper-protection abuse.
- The PoC chain was demonstrated executing unsigned code inside Microsoft Defender's PPL-protected MsMpEng.exe process (and SentinelOne's own SentinelAgent.exe) using NtMapViewOfSection, NtProtectVirtualMemory, and NtCreateThreadEx to reflectively map and run a statically-linked payload, after extracting a live COM secret (observed value {6c8844c0-0cd1-7a62-6f72-57d03fe54d6a}) via WinDbg.
- SentinelOne Agent 26.1.1, which remediates the SentinelHelper.Dump caller-validation gap, was already generally available at the time of public disclosure per Akamai's responsible-disclosure timeline.
- Cyber Security News published coverage of the BYOEDR research, corroborating the SentinelHelper Dump abuse and PPL bypass chain.
- GBHackers independently corroborated the Akamai research, confirming the SentinelOne Agent 26.1.1 fix and the DEF CON 34 attribution.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 9 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1106, T1055.002, T1620, T1036.005, T1685, T1685, T1553.006, T1027, T1057, T1518.001
