New Bring Your Own EDR Attack Turns SentinelOne Into Trojan Horse to Bypass Windows PPL

Gbhackers •Divya • August 14, 2026

Security researchers have introduced a new technique called “Bring Your Own EDR” (BYOEDR) that exploits legitimate SentinelOne components to bypass Windows Protected Process Light (PPL) protections, allowing the execution of unsigned code within highly secured processes. This research, presented by Akamai at DEF CON 34, demonstrates how trusted endpoint detection and response (EDR) software can […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New BYOEDR Attack Exploits SentinelOne to Bypass Windows PPL Protections Security researchers have unveiled a new attack method known as 'Bring Your Own EDR' (BYOEDR) that leverages legitimate components of SentinelOne to bypass Windows Protected Process Light (PPL) protections. This technique allows the execution of unsigned code within highly secured processes, posing a significant risk to systems relying on SentinelOne for endpoint protection. The research was presented by Akamai at DEF CON 34 in Las Vegas. SentinelOne has since addressed the vulnerability in Agent version 26.1.1, mitigating the risk of exploitation. The attack highlights the potential for trusted security tools to be misused, turning them into shields for malware. The scope of impact includes organizations using SentinelOne, which operates with high privileges and deep visibility into endpoint activities. Immediate action is recommended for affected users to update their software to the latest version. 2 sources 58

Extracted Entities

New Bring Your Own EDR Attack Turns SentinelOne Into Trojan Horse to Bypass Windows PPL

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)