Strange folder and files created after capture client latest update ***MUST READ***

NSA2650

Strange folder and files created after capture client latest update

Sentinel Agent - 21.6.2.272

Capture Client 3.6.29.3629

This folder and files got created on all our workstations as a hidden folder with files in it that are text, pdf and word. The files contain strange text, verified all files were not viruses/malware.

@Micah Please help understand why this happened.

Please see attached files and screenshot

CASE 43772288

2.JPG

3.jpg

4.JPG

1.png

Larry

@NSA2650 These are most likely "honeypot" files created by SentinelOne.

They are monitored by S1 and if they are changed in anyway (delete/encrypted), it is likely due to a malware or ransomware attack.

I believe they previously used the afterSentDocuments folder in My Documents, but moved to a more inconspicuous location with the new version level.

Micah

Hey @NSA2650, I moved this from CSC to the Capture Client category. I can also loop in @SuroopMC to confirm what Larry said above.

NSA2650

Thanks I'll wait for @SuroopMC to confirm this is normal.

BWC

These files were added in SentinelOne 21.6 as decoy files for monitoring bad Activities. They are enabled per default and can be disabled in the Threat Protection Policy at Advanced Settings -> Agent Configuration

--Michael@BWC

lutluc

Here is the response I have received from S1:

Having reviewed the screenshots provided, I can confirm that these are in fact files that have been created on the system by the Sentinel Agent.

These are canary files and form part of the Sentinel Agent's ransomware detection suite. As shown within your screenshot, all files will show the owner as SentinelOne and will be contained in various folders on the system.

This mechanism was first introduced in Agent V21.6.2.272, please see below an exert from our release notes:

"Enhanced ransomware detection, the agent drops files (Canary files) with open read/write permission, which are used for detection purposes. These files are dropped under C:\, C:\Users, and shared folders."