www.sentinelone.com
Open in
urlscan Pro
104.26.3.18
Public Scan
Submitted URL: http://www.sentinelone.com/blog/the-state-of-cloud-ransomware-in-2024/
Effective URL: https://www.sentinelone.com/blog/the-state-of-cloud-ransomware-in-2024/
Submission: On November 18 via api from DE — Scanned from DE
Effective URL: https://www.sentinelone.com/blog/the-state-of-cloud-ransomware-in-2024/
Submission: On November 18 via api from DE — Scanned from DE
Form analysis 6 forms found in the DOM
GET https://www.sentinelone.com
<form autocomplete="off" method="get" action="https://www.sentinelone.com">
<fieldset>
<input type="search" name="s" placeholder="Search ..." value="">
<button class="search" type="submit">
<img class="lazy icon-search" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='24' height='24'><rect width='100%' height='100%' fill='none'/></svg>"
data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg" alt="Search Icon" style="" width="24" height="24">
<img class="lazy icon-down" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='18' height='16'><rect width='100%' height='100%' fill='none'/></svg>"
data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg" alt="Navigation Close Dark" style="" width="18" height="16">
</button>
</fieldset>
</form>GET https://www.sentinelone.com/
<form role="search" method="get" class="search-form" action="https://www.sentinelone.com/">
<label>
<span class="screen-reader-text">Search ...</span>
<input type="search" class="search-field" placeholder="Search ..." value="" name="s">
</label>
<input type="submit" class="search-submit" value="Search">
</form><form id="mktoForm_1985" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;">
<style type="text/css"></style>
<div class="mktoFormRow">
<div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
<div class="mktoOffset" style="width: 5px;"></div>
<div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
<div class="mktoAsterix">*</div>
</label>
<div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Employees__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Address" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="City" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="PostalCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="SIC_Code2__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="demandbaseSID" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Phone" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="demandbaseCompany" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="demandbaseCountry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="demandbaseState" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="demandbaseEmployeeRange" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="subIndustry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="dataSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="watchListAccountType" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="watchListAccountOwner" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="watchListAccountStatus" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="watchListCampaignCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
<div class="mktoClear"></div>
</div>
<div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
<div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="/legal/privacy-notice/">Privacy Notice</a>. SentinelOne will not sell, trade, lease, or rent your personal data to
third parties. This site is protected by reCAPTCHA and the <a href="https://policies.google.com/privacy" target="_blank">Google Privacy Policy</a> and <a href="https://policies.google.com/terms" target="_blank">Terms of Service</a> apply.</div>
<input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="1985"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form><form id="mktoForm_2816" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;">
<style type="text/css"></style>
<div class="mktoFormRow">
<div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
<div class="mktoOffset" style="width: 5px;"></div>
<div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
<div class="mktoAsterix">*</div>
</label>
<div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 164px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
<div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="/legal/privacy-notice/">Privacy Notice</a>. SentinelOne will not sell, trade, lease, or rent your personal data to
third parties. This site is protected by reCAPTCHA and the <a href="https://policies.google.com/privacy" target="_blank">Google Privacy Policy</a> and <a href="https://policies.google.com/terms" target="_blank">Terms of Service</a> apply.</div>
<input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="2816"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form><form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form><form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>Text Content
A Leader in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms.
Four years running. A Leader in the Gartner® Magic Quadrant™
Read the Report
A Leader in the Gartner® Magic Quadrant™
Experiencing a Breach?
* 1-855-868-3733
* Small Business
* Contact
* Cybersecurity Blog
en
* English
* 日本語
* Deutsch
* Español
* Français
* Italiano
* Dutch
* 한국어
Get a Demo
blog
Platform
* Platform Overview
* Singularity Platform Welcome to Integrated
Enterprise Security
* How It Works The Singularity XDR Difference
* Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
* Pricing & Packaging Comparisons and Guidance at a Glance
* Data & AI
* Purple AI Accelerate SecOps with Generative AI
* AI-SIEM The AI SIEM for the Autonomous SOC
* Singularity Data Lake AI-Powered, Unified
Data Lake
* Singularity Data Lake for Log Analytics Seamlessly ingest data
from on-prem, cloud or hybrid environments
* Endpoint Security
* Singularity Endpoint Autonomous Prevention, Detection, and Response
* Singularity XDR Native & Open Protection, Detection, and Response
* Singularity RemoteOps Forensics Orchestrate Forensics at Scale
* Singularity
Threat Intelligence Comprehensive Adversary Intelligence
* Singularity Vulnerability Management Application & Os Vulnerability
Management
* Cloud Security
* Singularity Cloud Security Block Attacks With an
AI-powered CNAPP
* Singularity Cloud
Native Security Secure Cloud and Development Resources
* Singularity Cloud Workload Security Real-Time Cloud Workload Protection
Platform
* Singularity
Cloud Data Security AI-Powered Threat Detection for Cloud Storage
* Identity Security
* Singularity Identity Identity Threat Detection
and Response
Why SentinelOne?
* Why SentinelOne?
* Why SentinelOne? Cybersecurity Built
for What’s Next
* Our Customers Trusted by the World’s Leading Enterprises
* Industry Recognition Tested and Proven
by the Experts
* About Us The Industry Leader in Autonomous Cybersecurity
* Compare SentinelOne
* CrowdStrike Cyber Dependent
on a Crowd
* Wiz Smoke, Mirrors and
No Scale or Protection
* Microsoft Platform Coverage
That Compromises
* McAfee Pale Performance,
More Maintenance
* Palo Alto Networks Hard to Deploy,
Harder to Manage
* Trend Micro The Risk of DevOps Disruption
* Symantec Security Limited
to Signatures
* Carbon Black Adapt Only as Quickly
as Your Block Lists
* Verticals
* Energy
* Federal Government
* Finance
* Healthcare
* Higher Education
* K-12 Education
* Manufacturing
* Retail
Services
* Strategic Services
* PinnacleOne Strategic Advisory Group
Services Overview
* Managed Services
* Singularity MDR Tailored End-to-End MDR Service with Coverage on the
Endpoint and Beyond
* Vigilance MDR Essential 24x7 MDR Service with Reliable Endpoint Coverage
* Vigilance MDR+DFIR Essential 24x7 MDR Service with Extended DFIR Coverage
* WatchTower Pro Threat Hunting for Emerging Threat Campaigns
* Support, Deployment, & Health
* Technical Account Management Customer Success with Personalized Service
* SentinelOne GO Guided Onboarding & Deployment Advisory
* SentinelOne University Live and On-Demand Training
* Support Services Tiered Support Options for Every Organization
* SentinelOne Community Community Login
Partners
* Our Network
* MSSP Partners Succeed Faster
with SentinelOne
* Singularity Marketplace Extend the Power
of S1 Technology
* Cyber Risk
Partners Enlist Pro Response
and Advisory Teams
* Technology Alliances Integrated, Enterprise-Scale Solutions
* SentinelOne for AWS Hosted in AWS Regions Around the World
* Channel Partners Deliver the Right
Solutions, Together
Program Overview
Resources
* Resource Center
* Case Studies
* Data Sheets
* eBooks
* Reports
* Videos
* Webinars
* White Papers
View All Resources
* Blog
* Feature Spotlight
* For CISO/CIO
* From the Front Lines
* Identity
* Cloud
* macOS
* SentinelOne Blog
Blog
* Tech Resources
* SentinelLABS
* Ransomware Anthology
* Cybersecurity 101
About
* About SentinelOne
* About SentinelOne The Industry Leader in Cybersecurity
* Investor Relations Financial Information & Events
* SentinelLABS Threat Research for
the Modern Threat Hunter
* Careers The Latest Job Opportunities
* Press & News Company Announcements
* Cybersecurity Blog The Latest Cybersecurity Threats, News, & More
* F1 Racing SentinelOne &
Aston Martin F1 Team
* FAQ Get Answers to Our Most Frequently Asked Questions
* DataSet The Live Data Platform
* S Foundation Securing a Safer Future for All
* S Ventures Investing in the Next Generation
of Security, Data and AI
en
* English
* 日本語
* Deutsch
* Español
* Français
* Italiano
* Dutch
* 한국어
Get a Demo
THE STATE OF CLOUD RANSOMWARE IN 2024
November 14, 2024
by Alex Delamotte
PDF
OVERVIEW
Ransom attacks in the cloud are a perennially popular topic of discussion in the
cloud security realm. Cloud services inherently provide an advantage over
endpoint and web server-based services due to the minimal nature of a cloud
service’s attack surface. With the exception of Compute services, which run a
virtual operating system in the cloud, cloud services do not provide an entire
operating system, which means that the ransomware binaries prevalent on Windows
and Linux are unable to attack them effectively.
We have identified several tools designed to target web servers with ransomware
or to leverage cloud services to upload files before encrypting local files on
an endpoint. There are also far fewer references to scripts designed to perform
ransom attacks directly on cloud services, with the exception of several red
teaming tools hosted on GitHub.
Note: The scope of this report does not include attacks against on-premises
hosted cloud infrastructure, such as VMWare ESXi. Ransomware actors have long
targeted ESXi which was the first Linux operating system widely attacked by
organized ransomware groups.
CLOUD RANSOM ATTACK MECHANICS
Cloud ransom attacks typically target cloud-based storage services, such as
Amazon’s Simple Storage Service (S3) or Azure Blob Storage. While each
implementation varies, a ransom attack requires the attacker to find an
accessible storage service, copy the file contents to a destination controlled
by the attacker, and then encrypt or delete the files from the victim’s
instance.
Cloud service providers (CSPs) have implemented robust security mechanisms that
minimize the risk of data being lost permanently. For example, AWS’ Key
Management Service (KMS) defines a 7-day window between a key delete request and
its permanent deletion, providing users with ample time to detect and rectify a
cryptographic ransom attack against S3 instances.
One of the most commonly referenced cloud ransom techniques, outlined by Rhino
Security here, targets S3 buckets. The attacker takes advantage of an overly
permissive S3 bucket where they have write-level access, which is often the
result of misconfiguration or accessed in the targeted environment through other
means, such as valid credentials. This technique utilizes a new KMS key, meaning
the attacker would schedule the key for deletion and be subject to the 7-day
window before the key is permanently deleted in the victim’s environment.
Another technique targets Amazon’s Elastic Block Store (EBS) volumes through
similar means: the attacker creates a new KMS key, creates a snapshot of the EBS
volumes, encrypts the volumes, then deletes the original, unencrypted volume.
This technique is still subject to the 7-day key deletion policy, which provides
a window of opportunity for the customer to remediate before the key is deleted
forever.
Despite increasingly thorough security measures, researchers continue to find
new ways to circumvent CSP controls. In October 2024, security researcher Harsh
Varagiya published a potential technique to encrypt files on AWS using
customer-managed keys (CMK), also known as Bring Your Own Key (BYOK), and
external key stores (XKS). This technique allows an attacker to encrypt files in
such a way that the decryption key is controlled by the victim, which prevents
the CSP from recovering the key. While this attack is relatively niche and
targets only environments where the victim uses custom-managed key features, for
those customers it makes data recovery difficult, if not impossible, without
obtaining the key generated by the attacker. Organizations can prevent this type
of attack by implementing Service Control Policies (SCP) that block calls to
risky APIs, including the kms:CreateCustomKeyStore API.
RANSOMWARE USING CLOUD SERVICES FOR DATA EXFILTRATION
Aside from ransomware targeting cloud services, threat actors are increasingly
using cloud services to exfiltrate the data they intend to ransom. In September
2024, modePUSH reported that the BianLian and Rhysida ransomware groups are now
using Azure Storage Explorer to exfiltrate data from victim environments in lieu
of historically popular tools like MEGAsync and rclone. In October 2024, Trend
Micro reported that a ransomware actor mimicking the notorious Lockbit
ransomware group used samples that leverage Amazon’s S3 storage to exfiltrate
data stolen from the targeted Windows or macOS systems.
SentinelLabs has identified a Python script on VirusTotal that we call RansomES
due to the Spanish language comments in the code. RansomES is designed to run on
a Windows system and search for files with the extensions .doc, .xls, .jpg,
.png, or .txt. The script then provides the actor with methods to exfiltrate the
files to S3 or FTP, and then encrypt the local versions.
Exfiltration functions from RansomES
RansomES is a simple script and we do not believe it has been used in the wild.
The author included an internet connectivity check to the WannaCry killswitch
domain, which may suggest the script was developed by a researcher or someone
with an interest in threat intelligence.
RansomES connectivity check to WannaCry killswitch domain
WEB APPLICATION RANSOM ATTACKS
Web applications are often run via cloud services. Their more minimal nature
makes cloud environments a natural hosting point where the applications are
easier to manage and require less configuration and upkeep than running on a
full operating system. However, web applications themselves are vulnerable to
extortion attacks.
SentinelLabs has identified several ransom scripts that target PHP applications.
We identified a Python script called Pandora, a muti-tool targeting a variety of
web services. This tool is unrelated to the Pandora ransomware group, which
leverages binaries to target Windows systems. The Pandora script uses AES
encryption to target several types of systems, including PHP servers, Android,
and Linux. The PHP ransom functions encrypt files using AES via the OpenSSL
library. The Pandora Python script runs on the webserver, writing the PHP code
output to the path pandora/Ransomware with a file name provided as an argument
at runtime and appended with the .php extension.
Pandora’s ransomware1 PHP ransom function Pandora’s ransomware1 PHP ransom
function
We identified another PHP ransom script attributed to the IndoSec group, an
Indonesia-based threat actor. This script is a PHP backdoor that the attacker
can use to manage and delete files, and perform ransom attacks. The script
traverses directories recursively while it reads and base64-encodes file
contents. The encoded data is sent to
hxxp://encrypt[.]indsc[.]me/api[.]php?type=encrypt, where the file contents are
likely encrypted using a web service’s API. This is an interesting approach
because the encryption is provided through a remote service rather than using
native functionality like many other tools.
IndoSec’s PHP ransom script’s encryption routine
A notable example of a hybrid webserver and cloud ransomware combination is the
Cl0p ransomware group’s 2023 campaign that exploited CVE-2023-34362, a SQL
injection vulnerability in Progress Software’s MoveIT managed file transfer
application. The actors targeted files hosted in Azure blob storage when present
in the environment.
CONCLUSION
Cloud ransom attacks are an emerging threat that organizations are better
equipped to defend against now than in previous years given the continuous
dedication to CSP security measures in addition to a wealth of cloud security
products designed to minimize risk.
We recommend that all customers use a Cloud Security Posture Management (CSPM)
solution to discover and assess cloud environments and alert of issues such as
misconfiguration and overly permissive storage buckets, as these are the primary
flaws that facilitate the cloud ransom attack techniques we described in this
post. Additionally, always enforce good identity management practices such as
requiring MFA on all admin accounts, and deploy runtime protection against all
cloud workloads and resources.
INDICATORS OF COMPROMISE
RansomES
7bcffb6828915ae194e04739ebd12f57723a703b
Pandora
2139d0e1e618b61b017d62cb8806929560ded9a7
371ffe7849f9354e62919c203ed8f2e80b741622
57566050459d210263f3184d72c48a6b298c187b
785beb4b83c906dba3d336c4cbd0f442b0cbaf90
bb37e7565afae3f90258ec2664f4da49f5eec213
IndoSec
hxxp://encrypt[.]indsc[.]me/api[.]php?type=encrypt
9065e945947c939f55fbdf102a834f4ac5d87457
Singularity™ Cloud Security
Improve prioritization, respond faster, and surface actionable insights with
Singularity™ Cloud Security, the comprehensive, AI-powered CNAPP from
SentinelOne.
Get a Demo
--------------------------------------------------------------------------------
Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see
the content we post.
READ MORE ABOUT CYBER SECURITY
* DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn
Payloads
* Cloud and Container | The Attack & Defend Series
* macOS MetaStealer | New Family of Obfuscated Go Infostealers Spread in
Targeted Attacks
* Kryptina RaaS | From Underground Commodity to Open Source Threat
* January 2024 Cybercrime Update | Exploitation of Known CVEs, Crypto Drainers
& Ransomware Updates
* MOVEit Transfer Vulnerability used to Drop File-Stealing SQL Shell
READ MORE
Get a demo
Defeat every attack, at every stage of the threat lifecycle with SentinelOne
Book a demo and see the world’s most advanced cybersecurity platform in action.
Get Demo
SentinelLabs
SentinelLabs: Threat Intel & Malware Analysis
We are hunters, reversers, exploit developers, & tinkerers shedding light on the
vast world of malware, exploits, APTs, & cybercrime across all platforms.
VISIT SITE
Wizard Spider and Sandworm
MITRE Engenuity ATT&CK Evaluation Results
SentinelOne leads in the latest Evaluation with 100% prevention. Leading
analytic coverage. Leading visibility. Zero detection delays.
SEE RESULTS
Table of Contents
Overview
* Overview
* Cloud Ransom Attack Mechanics
* Ransomware Using Cloud Services For Data Exfiltration
* Web Application Ransom Attacks
* Conclusion
* Indicators of Compromise
SEARCH
Search ...
SIGN UP
Keep up to date with our weekly digest of articles.
*
Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Notice. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties. This site is protected by reCAPTCHA and the
Google Privacy Policy and Terms of Service apply.
Thanks! Keep an eye out for new content!
RECENT POSTS
* The Good, the Bad and the Ugly in Cybersecurity – Week 46
November 15, 2024
* Securing AWS Lambda | How Misconfigurations Can Lead to Lateral Movement
November 15, 2024
* The Good, the Bad and the Ugly in Cybersecurity – Week 45
November 8, 2024
BLOG CATEGORIES
* Cloud
* Company
* Data Platform
* Feature Spotlight
* For CISO/CIO
* From the Front Lines
* Identity
* Integrations & Partners
* macOS
* PinnacleOne
* The Good, the Bad and the Ugly
©2024 SentinelOne, All Rights Reserved.
Privacy Notice Master Subscription Agreement
Company
* Our Customers
* Why SentinelOne
* Platform
* About
* Partners
* Support
* Careers
* Legal & Compliance
* Security & Compliance
* Contact Us
* Investor Relations
Resources
* Blog
* Labs
* Product Tour
* Press
* News
* FAQ
* Resources
* Ransomware Anthology
Global Headquarters
444 Castro Street
Suite 400
Mountain View, CA 94041
+1-855-868-3733
sales@sentinelone.com
Sign Up For Our Newsletter
*
Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Notice. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties. This site is protected by reCAPTCHA and the
Google Privacy Policy and Terms of Service apply.
Thank you! You will now receive our weekly newsletter with all recent blog
posts. See you soon!
Language
English
* English
* 日本語
* Deutsch
* Español
* Français
* Italiano
* Dutch
* 한국어
We'd like to show you notifications for the latest news and updates.
AllowCancel
By clicking “Accept All Cookies”, you agree to the storing of cookies on your
device to enhance site navigation, analyze site usage, and assist in our
marketing efforts.
Cookies Settings Accept All Cookies
PRIVACY PREFERENCE CENTER
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All
MANAGE CONSENT PREFERENCES
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
Back Button
COOKIE LIST
Search Icon
Filter Icon
Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
Confirm My Choices