Isolated/bricked network connections
I have sentinelone running on a work computer, and one night, when trying to transfer a ton of files onto a network drive using robocopy, I got the message “This device has been isolated due to suspicious activity! (Or malware, can’t remember)”
There no malware, so I’m guessing S1 freaked out and thought it was an attack of some sort, and isolated me as well as cut off all network access. Ethernet and WiFi don’t work.
I called up our S1 vendor, but they couldn’t help because the PC is showing offline on their end (can’t communicate with it) and also, it shows no quarantine on their end.
So they gave me a bunch of commands to run with the agent passphrase.
I tried to unquarantine it, disable services, reload services, disable them in the registry, and even uninstall the agent but nothing worked. I did this in safe mode too but still no dice. The one thing I was able to do in safe mode was rename the folder to .old, but that didn’t disable services upon regular boot.
My vendor has escalated this to an S1 engineer, but he advised himself that we just run the commands that I’ve already previously run. I can’t even grab the logs manually to give to them because it won’t let me.