DLL Sideloading via SentinelOne Executable in Suspicious Location

Tim Peck@timpeck

•updated Aug 22, 2025•1•1•56

Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.