The “Bring Your Own Installer” (BYOI) technique exploited in this attack revolves around a legitimate process used by SentinelOne’s Endpoint Detection and Response (EDR) agent: the upgrade and downgrade mechanism. Normally, SentinelOne agents include tamper protection to prevent unauthorized actions like uninstallation, deactivation, or replacement of critical components. However, this protection is intentionally and temporarily disabled when the agent is being upgraded or downgraded to facilitate the change in software versions.

The attack starts by leveraging this downgrade logic, which is not strictly gated behind administrative authorization when misconfigured. An attacker with local access to the machine such as via malware, a compromised account, or remote desktop can supply an older, valid SentinelOne Windows installer. This installer can be a legitimate version previously obtained or scraped from the internet. When executed, it initiates a rollback or reinstallation process that causes the agent to suspend its self-protection mechanisms. During this brief period, core EDR services like monitoring, telemetry, and threat detection may stop or run in a less secure state.

Once the system is in this vulnerable window, the attacker can:

• Terminate security-related processes or services.
• Replace SentinelOne binaries with trojanized or inert versions.
• Install or execute malware without triggering alerts.
• Modify or delete logs that would otherwise flag suspicious behavior.

This is particularly dangerous because the downgrade process doesn’t always require elevated privileges when improperly configured. Moreover, some Windows environments allow software management policies that do not enforce digital signature verification for rollback installers, allowing attackers to use slightly modified or unsigned versions of the agent binary to execute the attack.

To maintain stealth, adversaries can couple this with living-off-the-land binaries (LOLBins) or scripting frameworks (e.g., PowerShell, WMI) to execute the downgrade and payload delivery silently in the background. They might even automate the process using batch scripts or system scheduler tasks.

Additionally, researchers noted that after disabling SentinelOne, attackers used this access to:

• Exfiltrate sensitive data before launching ransomware payloads.
• Install secondary persistence mechanisms (e.g., registry run keys, scheduled tasks).
• Exploit lateral movement opportunities within the network once defenses were neutralized.

From a security engineering standpoint, the core flaw isn’t a software bug (no CVE has been assigned) but rather a weakness in trust assumptions around local agent control and upgrade operations. If local users or malware can impersonate a legitimate upgrade action, then EDR protections can be nullified in seconds, offering an ideal prelude for attacks like ransomware or advanced persistent threats (APTs).