BYOEDR: Weaponizing SentinelOne to Bypass Windows Protected Process Light PPL

The "Bring Your Own EDR" (BYOEDR) technique evolves the "Bring Your Own Vulnerable Driver" (BYOVD) vector by weaponizing legitimate, digitally signed components from trusted security vendors, specifically SentinelOne. Because EDR drivers possess high-level system privileges to monitor activity, they can be leveraged to manipulate kernel-mode process protection flags. By flipping PPL bits, attackers strip the "Protected" status from critical system processes such as lsass.exe. This bypasses Windows Protected Process Light (PPL) protections, facilitating unauthorized memory reads, credential dumping, and process injection, ultimately enabling full administrative takeover and lateral movement through stolen high-privileged credentials.

• Vulnerability Overview: Evolution of BYOVD

  • Evolves the "Bring Your Own Vulnerable Driver" (BYOVD) methodology into a more stealthy "Bring Your Own EDR" (BYOEDR) approach.
  • Utilizes legitimate, digitally signed EDR components to circumvent kernel-level security boundaries.
  • Exploits the inherent trust and high-level privileges natively granted to EDR drivers by the Windows kernel.

• Technical Deep Dive: PPL Subversion

  • Attack Vector: Deployment of SentinelOne kernel drivers (.sys) and service binaries to gain kernel-mode execution.
  • Mechanism: Leverages driver-level privileges to manipulate kernel memory and flip Protected Process Light (PPL) bits.
  • Primary Target: Targeted stripping of protection status from critical system processes, specifically the Local Security Authority Subsystem Service (lsass.exe).

• Impact Assessment: Critical Risks

  • Primary Impact: Complete bypass of Windows PPL, neutralizing a core kernel security mechanism.
  • Credential Exposure: Enables unauthorized credential dumping from lsass.exe despite active PPL enforcement.
  • Systemic Risk: Facilitates administrative takeover and lateral movement through high-privileged credential theft.

• Detection and Mitigation: Defensive Posture

  • Detection: Monitor for anomalous driver load events associated with EDR binaries appearing in non-standard file paths.
  • Monitoring: Identify unexpected installation of SentinelOne components on systems not managed by the official corporate security stack.
  • Audit: Implement kernel-level monitoring for unauthorized modifications to process protection flags in kernel memory.