DLL Side-Loading × SentinelOne agent (sentinelmemoryscanner.exe component)

Attackers used DLL sideloading with a legitimate signed SentinelOne binary... to load a malicious DLL... evading endpoint detection.

Attackers placed a legitimate signed SentinelOne executable (sentinelmemoryscanner.exe) alongside a malicious DLL (sentinelagentcore.dll) on target systems. When executed via node.exe, the signed binary sideloads the malicious DLL, which runs ChromElevator to harvest passwords, cookies, and payment data from Chromium browsers. This abuses the trust in the signed security product binary to bypass path-based and signature-based detection.

Monitor for unexpected process creation of signed security product binaries (e.g., sentinelmemoryscanner.exe) from non-standard directories or launched by unusual parent processes like node.exe. Use application control to restrict DLL loading from untrusted paths and ensure security product binaries are only executed from their legitimate installation directories.