Blog

featured
Posted on

SentinelOne Virtual Appliance: Cloud When You Want It, On-premises When You Need It

We are pleased to announce the immediate availability of the SentinelOne Virtual Appliance for customers who prefer to have their security consoles running in their own data centers.  SentinelOne has been serving the needs of these customers from our early days, but the new appliance cuts down the complexity in setting up the console on-premises. […]

READ MORE
Posted on

Securing Virtual Desktop Infrastructure (VDI)

The SentinelOne agent is an efficient solution to secure the growing demand for agent virtualization, including thin clients, layered apps, and other VDI scenarios. It does not require updates and is not dependent on signatures or other legacy antivirus features. The SentinelOne offering for VDI includes all protection engines and functionality, the same as we […]

READ MORE
Posted on

Dissecting NotPetya: So you thought it was ransomware

By Caleb Fenton, Joseph Landry, Nir Izraeli, Itai Liba, and Udi Shamir, Senior Security Researchers, SentinelOne Labs NotPetya was in the news this week, making headlines for being yet another ransomware attack that spread like fire – affecting organizations in several verticals across 65+ countries, drawing comparisons with the WannaCry attack that recently hit over […]

READ MORE
Posted on

Petya/NotPetya ransomware: What you need to know

Our SentinelOne research team is actively monitoring the Petya/NotPetya ransomware outbreak and we will update this blog post as more technical information about this attack is discovered. SentinelOne is proactively protecting customers against this latest strain. All SentinelOne customers using SentinelOne Enterprise Protection Platform are proactively protected against this outbreak.* Customers should also ensure that […]

READ MORE
Posted on

Are we done with WannaCry?

Several customers and industry analysts frequently ask us (and other vendors) about independent validation of our capabilities. We wanted to share information about a recent test conducted by MRG-Effitas to validate the effectiveness of various traditional and next-generation endpoint security suites against the EternalBlue and Doublepulsar exploits/backdoor. These threats were unearthed by “The Shadow Brokers” […]

READ MORE
Posted on

Armory Sandbox – Building a USB analyzer with USB armory

Some time ago a friend received a mysterious USB pen with a note talking about some kind of heavily persistent malware. He had that USB pen stored untouched and of course my curiosity took over. Since one should never plug in unknown USB devices into a computer (well, any USB device we purchase is unknown […]

READ MORE
Posted on

“Zusy” PowerPoint Malware Spreads Without Needing Macros

By Caleb Fenton and Itai Liba, Senior Security Researchers, SentinelOne Labs A new variant of a malware called “Zusy” has been found in the wild spreading as a PowerPoint file attached to spam emails with titles like “Purchase Order #130527” and “Confirmation”. It’s interesting because it doesn’t require the user to enable macros to execute. […]

READ MORE
Posted on

The Executive Order on Cybersecurity: Can We Finally Get on the Right Path?

The recent WannaCry campaign took over news cycles, hindering an evaluation of Trump’s recent cybersecurity Executive Order (EO) — but I’ll admit, upon closer scrutiny, it’s a good start. This is particularly true if the goal is to kickstart a national cybersecurity strategy from scratch. As a whole, there are no glaring errors despite some […]

READ MORE
Posted on

New “Widia” Ransomware Asks for Credit Card for Payment

By Caleb Fenton and Itai Liba, Senior Security Researchers, SentinelOne Labs While hunting for new types of undetected ransomware, we came across a sample we’re calling Widia. Below is the ransom note it displays once it’s infected the device: Your documents, photos, databases and other important files have been encrypted with the strongest encryption and unique […]

READ MORE