edr:sentinelone
SentinelOne Singularity telemetry
Deep Visibility / Cloud Funnel events
- Host type
- EDR sensors (product telemetry, cross-platform)
- Tier, as a whole
- Recommended
- Cost class
- Paid service
- Techniques
- 0
- Rules listed
- 459
- Events
- 0
Licensing
- License or service
- Singularity Complete and above; Cloud Funnel for raw telemetry export
- What is free
- Console and Deep Visibility with the subscription
- What costs
- Raw telemetry export (Cloud Funnel) and Singularity Data Lake retention are licensed add-ons; verify with the vendor
- Notes
- No public event-name documentation read; kept at the source level
- Vendor page
- https://www.sentinelone.com/platform/
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 442
- AWS CLI Command with Custom Endpoint URL
- AWS SSM Agent Registered via Hybrid Activation
- AWS SSM Session Manager Child Process Execution
- Access Control List Modification via setfacl
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Alternate Data Stream Creation/Execution at Volume Root Directory
- AppArmor Profile Compilation via apparmor_parser
- Attempt to Clear Kernel Ring Buffer
- Attempt to Clear Logs via Journalctl
- Attempt to Disable Auditd Service
- Attempt to Disable IPTables or Firewall
- Attempt to Disable Syslog Service
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- BPF Program Tampering via bpftool
- BPF Program or Map Load via bpftool
- BPF filter applied using TC
- Backup Deletion with Wbadmin
- Base16 or Base32 Encoding/Decoding Activity
- Boot File Copy
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Chkconfig Service Add
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Command and Scripting Interpreter via Windows Scripts
- Conhost Spawned By Suspicious Parent Process
- Connection to Common Large Language Model Endpoints
- Connection to Commonly Abused Web Services
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Control Panel Process with Unusual Arguments
- Creation of Hidden Shared Object File
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Cupsd or Foomatic-rip Shell Execution
- Curl or Wget Spawned via Node.js
- D-Bus Service Created
- DNF Package Manager Plugin File Creation
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Data Encrypted via OpenSSL Utility
- Delete Volume USN Journal with Fsutil
- Direct Process Execution via Background Utility
- Directory Creation in /bin directory
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Docker Socket Enumeration
- Dracut Module Creation
- Dynamic Linker (ld.so) Creation
- Dynamic Linker Copy
- ESXI Discovery via Find
- ESXI Discovery via Grep
- ESXI Timestomping using Touch Command
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumeration Command Spawned via WMIPrvSE
- Executable Bit Set for Potential Persistence Script
- Executable File Creation with Multiple Extensions
- Executable Masquerading as Kernel Process
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exporting Exchange Mailbox via PowerShell
- File Creation by Cups or Foomatic-rip Child
- File Creation in /var/log via Suspicious Process
- File Creation in World-Writable Directory by Unusual Process
- File Deletion via Shred
- File Transfer or Listener Established via Netcat
- File made Immutable by Chattr
- File with Right-to-Left Override Character (RTLO) Created/Executed
- First Time Seen Removable Device
- GRUB Configuration File Creation
- GRUB Configuration Generation through Built-in Utilities
- GenAI Process Compiling or Generating Executables
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Git Hook Child Process
- Git Hook Command Execution
- Git Hook Created or Modified
- Group Policy Discovery via Microsoft GPResult Utility
- Hidden Directory Creation via Unusual Parent
- Hidden Files and Directories via Hidden Flag
- Host File System Changes via Windows Subsystem for Linux
- Hping Process Activity
- IIS HTTP Logging Disabled
- IPv4/IPv6 Forwarding Activity
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- InstallUtil Process Making Network Connections
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python
- KDE AutoStart Script or Desktop File Creation
- Kerberos Traffic from Unusual Process
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Removal
- Kirbi File Creation
- Kubectl Apply Pod from URL
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubernetes Direct API Request via Curl or Wget
- LSASS Memory Dump Creation
- Lateral Movement via Startup Folder
- Linux Audio Recording Activity Detected
- Linux Clipboard Activity Detected
- Linux External IP Address Discovery via Curl
- Linux Firewall Rule Creation or Modification
- Linux Process Hooking via GDB
- Linux SSH X11 Forwarding
- Linux System Information Discovery
- Linux Telegram API Request
- Linux User Added to Privileged Group
- Linux Video Recording or Screenshot Activity Detected
- Linux init (PID 1) Secret Dump via GDB
- Local Account TokenFilter Policy Disabled
- MS Office Macro Security Registry Modifications
- Manual Dracut Execution
- Manual Memory Dumping via Proc Filesystem
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Memory Swap Modification
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Mounting Hidden or WebDav Remote Shares
- Mshta Making Network Connections
- MsiExec Service Child Process With Network Connection
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- Namespace Manipulation Using Unshare
- NetSupport Manager Execution from an Unusual Path
- Netcat Listener Established via rlwrap
- Netsh Helper DLL
- Network Activity to a Suspicious Top Level Domain
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Signed Binary
- Network-Level Authentication (NLA) Disabled
- NetworkManager Dispatcher Script Creation
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Seen Commonly Abused Network Scanner
- Node.js Pre or Post-Install Script Execution
- Nping Process Activity
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- OpenSSL Password Hash Generation
- Openssl Client or Server Activity
- Outlook Home Page Registry Modification
- Passwordless Sudo Probing
- Peripheral Device Discovery
- Persistence via BITS Job Notify Cmdline
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistent Scripts in the Startup Directory
- Pluggable Authentication Module (PAM) Creation in Unusual Directory
- Pluggable Authentication Module (PAM) Version Discovery
- Pod or Container Creation with Suspicious Command-Line
- Polkit Policy Creation
- Polkit Version Discovery
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential CVE-2025-33053 Exploitation
- Potential Chroot Container Escape via Mount
- Potential ClickFix Command via Windows Run Dialog
- Potential Container Escape via Kernel core_pattern Modification
- Potential Credential Access via Windows Utilities
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Curl
- Potential Data Exfiltration Through Wget
- Potential Data Exfiltration via Rclone
- Potential Data Splitting Detected
- Potential Database Dumping Activity
- Potential Defense Evasion via Doas
- Potential Defense Evasion via PRoot
- Potential Disabling of AppArmor
- Potential Disabling of SELinux
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Escalation via Vulnerable MSI Repair
- Potential Evasion via Filter Manager
- Potential Execution via FileFix Phishing Attack
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential FileFix Command via Windows Explorer Address Bar
- Potential Fileless Execution via O_TMPFILE
- Potential Foxmail Exploitation
- Potential Git CVE-2025-48384 Exploitation
- Potential Hex Payload Execution via Command-Line
- Potential Hex Payload Execution via Common Utility
- Potential Hidden Process via Mount Hidepid
- Potential IIS Web Shell File Creation
- Potential Impersonation Attempt via Kubectl
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential Kubectl Masquerading via Unexpected Process
- Potential Linux Backdoor User Account Creation
- Potential Linux Credential Dumping via Proc Filesystem
- Potential Linux Credential Dumping via Unshadow
- Potential Linux Hack Tool Launched
- Potential Linux Tunneling and/or Port Forwarding
- Potential Linux Tunneling and/or Port Forwarding via Command Line
- Potential Linux Tunneling and/or Port Forwarding via SSH Option
- Potential Local NTLM Relay via HTTP
- Potential Masquerading as Communication Apps
- Potential NetNTLMv1 Downgrade Attack
- Potential Network Scan Executed From Host
- Potential Notepad Markdown RCE Exploitation
- Potential OpenSSH Backdoor Logging Activity
- Potential Persistence via Time Provider Modification
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via EarthWorm
- Potential Protocol Tunneling via Yuze
- Potential Proxy Execution via Systemd-run
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential Reverse Shell via Background Process
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential Shell via Wildcard Injection Detected
- Potential Sudo Privilege Escalation via CVE-2019-14287
- Potential Suspicious File Edit
- Potential System Tampering via File Modification
- Potential THC Tool Downloaded
- Potential Telnet Authentication Bypass (CVE-2026-24061)
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Unauthorized Access via Wildcard Injection Detected
- Potential Upgrade of Non-interactive Shell
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential privilege escalation via CVE-2022-38028
- Potentially Suspicious Process Started via tmux or screen
- PowerShell Script Block Logging Disabled
- Printer User (lp) Shell Execution
- Private Key Searching Activity
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Privileged Container Creation with Host Directory Mount
- Privileged Docker Container Creation
- Process Activity via Compiled HTML File
- Process Backgrounded by Unusual Parent
- Process Capability Set via setcap Utility
- Process Execution from an Unusual Directory
- Process Spawned from Message-of-the-Day (MOTD)
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- ProxyChains Activity
- PsExec Network Connection
- RDP Enabled via Registry
- Rare SMB Connection to the Internet
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote File Copy to a Hidden Share
- Remote File Copy via TeamViewer
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Remote Scheduled Task Creation
- Root Certificate Installation
- SELinux Configuration Creation or Renaming
- SIP Provider Modification
- SSH Key Generated via ssh-keygen
- SSL Certificate Deletion
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Security File Access via Common Utilities
- Sensitive Files Compression
- SentinelOne Alert External Alerts
- SentinelOne Threat External Alerts
- Service DACL Modification via sc.exe
- Setcap setuid/setgid Capability Set
- Shared Object Load via LoLBin
- Shell Execution via Elastic Endpoint
- Signed Proxy Execution via MS Work Folders
- Simple HTTP Web Server Creation
- SolarWinds Process Disabling Services via Registry
- Startup Persistence by a Suspicious Process
- Sudo Command Enumeration Detected
- Suspicious .NET Code Compilation
- Suspicious /proc/maps Discovery
- Suspicious APT Package Manager Execution
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Command Execution via Busybox Proxy
- Suspicious Command Prompt Network Connection
- Suspicious Communication App Child Process
- Suspicious Content Extracted or Decompressed via Funzip
- Suspicious Dynamic Linker Discovery via od
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from Foomatic-rip or Cupsd Parent
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious Execution via Windows Subsystem for Linux
- Suspicious Execution with NodeJS
- Suspicious Explorer Child Process
- Suspicious File Creation via Kworker
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious JetBrains TeamCity Child Process
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Memory grep Activity
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious Mining Process Creation Event
- Suspicious Named Pipe Creation
- Suspicious PDF Reader Child Process
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious React Server Child Process
- Suspicious Reading of procfs Syscall File
- Suspicious ScreenConnect Client Child Process
- Suspicious Shell Execution via Velociraptor
- Suspicious SolarWinds Child Process
- Suspicious Startup Shell Folder Modification
- Suspicious Utility Launched via ProxyChains
- Suspicious WerFault Child Process
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Write Attempt to AppArmor Policy Management Files
- Suspicious Zoom Child Process
- Suspicious which Enumeration
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Information Discovery via dmidecode from Parent Shell
- System Log File Deletion
- System Owner/User Discovery Linux
- System Public IP Discovery via DNS Query
- System Shells via Services
- System V Init Script Created
- Third-party Backup Files Deleted via Unexpected Process
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via Windows Firewall Snap-In Hijack
- Unix Socket Connection
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual D-Bus Daemon Child Process
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution via Microsoft Common Console File
- Unusual File Creation - Alternate Data Stream
- Unusual Network Connection via DllHost
- Unusual Network Connection via RunDLL32
- Unusual Parent Process for cmd.exe
- Unusual Parent-Child Relationship
- Unusual Persistence via Services Registry
- Unusual Pkexec Execution
- Unusual Print Spooler Child Process
- Unusual Process Execution Path - Alternate Data Stream
- Unusual Process Network Connection
- Unusual Service Host Child Process - Childless Service
- User Account Creation
- Virtual Machine Fingerprinting
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- Web Server Spawned via Python
- Web Shell Detection: Script Process Child of Common Web Processes
- Werfault ReflectDebugger Persistence
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Sandbox with Sensitive Configuration
- Windows Script Executing PowerShell
- Windows Script Execution from Archive
- Windows Server Update Service Spawning Suspicious Processes
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Wireless Credential Dumping using Netsh Command
- XDG-Open Command Execution
- Yum/DNF Plugin Status Discovery
Microsoft Sentinel 17
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detect Print Processors Registry Driver Key Creation/Modification
- Detect Registry Run Key Creation/Modification
- Detect Windows Allow Firewall Rule Addition/Modification
- Detect Windows Update Disabled from Registry
- Process Creation with Suspicious CommandLine Arguments
- Sentinel One - Admin login from new location
- Sentinel One - Agent uninstalled from multiple hosts
- Sentinel One - Alert from custom rule
- Sentinel One - Blacklist hash deleted
- Sentinel One - Exclusion added
- Sentinel One - Multiple alerts on host
- Sentinel One - New admin created
- Sentinel One - Rule deleted
- Sentinel One - Rule disabled
- Sentinel One - Same custom rule triggered on different hosts
- Sentinel One - User viewed agent's passphrase
Events
No event-level rows: this source is tiered as a whole.