When the EDR Becomes the Malware's Bodyguard

Akamai's Bring Your Own EDR research shows how an attacker with local administrator access could turn SentinelOne's privileged functions and self-protection into tools for intrusion.

Most malware that lands on a Windows endpoint has a familiar problem: the security agent is already there. It watches processes, protects its own files, and can cross Windows boundaries that ordinary applications cannot.

Akamai's Bring Your Own EDR (BYOEDR) research asks what happens when an attacker uses that advantage. The researchers showed that someone who already has local administrator access could abuse SentinelOne components to reach protected processes, run code in a Protected Process Light context, manipulate the agent's self-protection, and disrupt its cloud connection. The finding is a reminder to monitor the security tool itself, not just what it detects.

Why an EDR Is Such a Valuable Target

Endpoint detection and response software needs unusually broad access to observe processes, memory, files, and registry activity. Windows Protected Process Light (PPL) helps shield security processes from interference. Even a local administrator cannot automatically inspect or terminate every PPL process.

Akamai looked for SentinelOne functions callable from outside that boundary but performed with the agent's protected privileges. That difference between who requests an operation and who executes it is central to the research.

The Protected Process Shortcut

Researchers identified a SentinelOne COM interface with a process-dumping function. Process dumps serve legitimate diagnostic needs, but in this case an administrator could request a dump that SentinelOne performed from its own protected context. That let the caller access a protected target that a normal administrative process could not dump directly.

The sequence is straightforward: an attacker has local administrator privileges, calls a legitimate EDR interface, and the EDR performs the sensitive operation with its own access. Akamai chained this behavior with earlier Microsoft Defender research to demonstrate execution of attacker-controlled code in a PPL context.

This does not provide initial access to a machine. It does show how an attacker who already controls an endpoint can cross a boundary that is meant to withstand ordinary administrator-level tampering.

What If SentinelOne Is Not Installed?

The name BYOEDR becomes literal here. Akamai examined whether an attacker could bring a SentinelOne installer to a compromised system. Its research identified a registration weakness that allowed an agent to be installed without normal connection to a legitimate management environment. The attacker could then make use of the privileged local components they had introduced.

It resembles Bring Your Own Vulnerable Driver, where an attacker installs a legitimate signed driver and abuses its privileged access. In this case, the imported component is an endpoint security product.

Turning Anti-Tamper Into Anti-Removal

EDR self-protection is designed to stop attackers from modifying agent files and services. Akamai demonstrated a way to temporarily disable protection, place attacker-controlled content in protected locations, and restore protection. The agent could then protect the modified content along with its own files.

The consequence is more than evasion. The attacker can try to make a defensive control resist removal of the attacker's own code. Akamai reported the SentinelOne issue was fixed in Agent version 26.1.1, so teams should verify their deployed versions and vendor guidance.

Cutting the SOC Out of the Loop

An installed agent does not guarantee that analysts can see what it is doing. Akamai showed that local DNS changes could interrupt SentinelOne's communication with its management platform while the local agent remained present.

This makes management connectivity an independent signal. A device that stops checking in after administrator activity or security configuration changes deserves investigation, even if the agent appears installed on the machine.

CyopScape Lab Note

Hunt for EDR health changes

Agent health is a detection surface in its own right. If the tool that reports on an endpoint can be quieted from that endpoint, the absence of reporting has to become something you hunt for rather than something you wait to notice.

For Microsoft Defender environments, this KQL query provides a quick view of devices whose latest reported sensor state is not Active:

Defender for Endpoint · KQL

DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| project Timestamp, DeviceName, OnboardingStatus, SensorHealthState
| where SensorHealthState != "Active"

A nonactive sensor is not automatically malicious. Laptops sleep, networks fail, and services break. Correlate the health change with administrative sign-ins, security-service changes, DNS or hosts-file edits, and recent software installs. In other EDR platforms, use the equivalent agent-health and management-connectivity signals.

Defensive Takeaways

Limit local administrator access

The demonstrated chain requires local administrator privileges. Remove unnecessary standing rights and investigate unexpected elevations and new local admin accounts.

Monitor changes to the agent

Alert on protection being disabled or restored, agent repair or installation outside approved deployment tools, and modifications to security-product directories. Treat EDR software as a privileged application that can itself be targeted.

Check management connectivity

Investigate agents that stop reporting to the console, especially when the timing coincides with DNS, proxy, firewall, or hosts-file changes. Track the agent version and apply vendor fixes promptly.

Final Thoughts

EDR remains a valuable defense, but its privileged interfaces and self-protection are part of the endpoint attack surface. Akamai's research shows that an attacker with administrator access can sometimes repurpose the trust placed in security software. Defenders should protect and monitor the EDR with the same care they apply to other critical infrastructure.

Sources

Akamai Security Research, "Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse" (Aug 7, 2026)
TLDR Information Security, summary of Akamai's BYOEDR research (Sept 18, 2026)

← Back to Insights