What SentinelOne Actually Catches: Real Threat Detections on NZ Endpoints

SentinelOne's behavioural detection engine — Singularity — monitors every process running on protected endpoints, building a real-time model of what is happening and why. When a process behaves in a way that matches known attack patterns, or exhibits sequences of behaviour anomalous enough to indicate malicious intent, SentinelOne identifies the threat, kills the process, and — if ransomware has begun encrypting files — can roll back the changes.

Here are representative detection categories from NZ endpoint deployments, what they represent, and why they weren't caught by the antivirus they replaced.

Credential Harvesting via LSASS Memory Access

A Word document opened by a staff member executed a macro that launched PowerShell. The PowerShell script attempted to read the LSASS (Local Security Authority Subsystem Service) process memory — the Windows component that stores cached credentials. This is a standard credential harvesting technique used by Mimikatz and similar tools to extract plaintext passwords and hashes from memory.

SentinelOne detected the LSASS memory access as a high-confidence malicious behaviour and killed the PowerShell process. The Word document was isolated. The previous antivirus saw a standard PowerShell execution — no malicious file to scan — and did nothing. Harvested credentials from LSASS would have given the attacker authenticated access to other systems on the same network.

Ransomware Rollback: 47 Files Encrypted Before Kill

A staff member on a remote working setup downloaded a file posing as an invoice PDF. The file executed a dropper that launched a ransomware payload in memory. SentinelOne detected the ransomware's file encryption behaviour — the pattern of reading a file, encrypting it, writing the encrypted version, and moving to the next file — and killed the process after 47 files had been encrypted. The rollback feature automatically restored all 47 files to their pre-encryption state. Total downtime: approximately four minutes while the endpoint was isolated and remediated. Without rollback, those 47 files would have remained encrypted pending full recovery from backup.

Malicious Browser Extension Detected via Network Behaviour

An endpoint at an Auckland professional services firm had a browser extension installed that was exfiltrating data — sending form contents (including data entered into web-based business applications) to a remote server. The extension itself was not flagged by the Chrome Web Store and passed signature scanning. SentinelOne identified the extension's behaviour as anomalous: a browser extension making repeated outbound POST requests to a domain registered 11 days prior, from a user session during which no web browsing to that domain had occurred. The threat was flagged for investigation; the extension was removed and the affected accounts had credentials reset.

Cryptominer Stranded by DNS Blocking

A legitimate-looking software download included a bundled cryptominer — common in software downloaded from unofficial sources. The miner installed silently and ran at low CPU utilisation to avoid obvious detection. SentinelOne flagged the process based on its connections to known mining pool infrastructure. DNS filtering simultaneously blocked the outbound DNS queries to the mining pool domain. The miner was running but couldn't connect to the pool — rendering it ineffective — while SentinelOne's alert notified the Optimyze SOC team. Without EDR, the miner would have continued silently for months.

Every one of these detections would have succeeded in a different outcome without behavioural EDR in place. The pattern is consistent: traditional antivirus misses the initial execution because there's no malicious file to scan. EDR catches the malicious behaviour in the first minutes of activity.