Just finished running a breach simulation in our test AWS environment. We used some common initial access techniques and then tried to deploy a stealthy command & control beacon. SentinelOne caught about 80% of the activity, which seems good? It blocked the initial payloads and some lateral movement.
But the C2 beacon that used living-off-the-land techniques (like PowerShell stuff) and a slow call-back schedule totally slipped through. It was marked as "suspicious" but not killed. Now I'm wondering about the configuration. Is this normal for S1? Do you have to really fine-tune the policies to catch the super stealthy stuff, or is this a known gap? What's your experience?
Still learning
Yeah, that sounds pretty familiar. S1 is aggressive with outright malicious payloads but often flags LOTL stuff as "suspicious" and leaves the final call to you. That "suspicious but not killed" state is the tricky part.
You probably need to crank up the policy sensitivity for scripting engines, especially PowerShell. Look at the "Suspicious Process Detection" module and maybe enable "Suspicious Process Termination." It's a balance though - too strict and you'll get more false positives from legitimate admin scripts.
Did your C2 beacon use any obfuscation? Sometimes adding a custom IOC for the specific command pattern or network callback can bridge that gap until their behavioral AI catches up.