SentinelOne
Named by 6 kept items in this workspace.
2 items name it under affected products, 2 under classification.key entities, 1 under classification.technologies and 1 under tools.
Search every workspace for SentinelOne. It matches the name as written, so it can find other things that share it.
The items that name it 6
Security software whose processes (SentinelMemoryScanner.exe, SentinelUI.exe) were killed and services (SentinelStaticEngine, SentinelAgent, SentinelHelperService) stopped by the threat actor
Impersonated via forged PE version-info metadata ('SentinelOne Compatibility Wizard' v1.1.6.0) in v2; also an AV/EDR scan target.
EDR tool watching for anomalous process behavior, suspicious file system changes, and C2 callbacks
All technologies in this workspace.