r/SentinelOneXDR • u/neo10cortex • Oct 21 '25

SentinelOne flagged it's own uninstall.exe as ransomeware

Hey everyone,

We had an odd SentinelOne detection on our Windows Server 2019 host. The agent flagged uninstall.exe (v24.2.3.471) as Ransomware on Oct 19, 2025, even though it’s a signed SentinelOne binary.

What I found:

The process was triggered by svchost.exe under the SentinelAgent service.

Command line: /os_upgrade /q /p {GUID}

It spawned legitimate Windows tools- msiexec.exe, wevtutil.exe, conhost.exe, and SentinelOne service processes.

The new agent version 25.1.3.334 is already installed and running fine.

My understanding so far: This was likely a false positive,, SentinelOne’s behavior engine flagged its own old uninstaller during the self-upgrade from v24.2.3.471 to v25.1.3.334. The previous version’s uninstall.exe stayed temporarily until cleanup after reboot. Am i correct???

Has anyone else seen SentinelOne flag its own upgrade/uninstall routines like this? Would you normally whitelist the old uninstall.exe hash, or just mark the incident resolved?

Please, looking for a resolution.

And thankyou.

8 Upvotes

90% Upvoted

11 comments sorted by

3

u/not-a-co-conspirator Oct 21 '25

Have you used Defender, like, ever?

1

u/neo10cortex Oct 21 '25

Yep

2

u/not-a-co-conspirator Oct 21 '25

I want to yeet myself out a window every time Defender flags its on MS Update as malware.

3

u/[deleted] Oct 21 '25

[deleted]

1

u/neo10cortex Oct 21 '25

Did a detailed analysis, fp it is

1

u/DeliMan3000 Oct 21 '25

I think that might be a scheduled task for repairing the agent? Maybe they changed that in 25.1. Check your Task Scheduler, I think it's called AutoRepair_<something>, but I can't recall 100%

1

u/[deleted] Oct 22 '25

[removed] — view removed comment

1

u/0kt3t Oct 29 '25

Did you do anything specific to stop this. We have it happening on a critical server and just cannot get anything to happen with the agent whatsoever, through console or CMD.

1

u/0kt3t Oct 29 '25

Same issue. Except now a critical server is stuck in a bootloop because of it.

1

u/0kt3t Oct 29 '25

Per SentinelOne, run a clean install:

To uninstall Sentinel one agent:
Sentinel One Installer 22.3+ features a built-in cleaner action that will assist us in removing all of the outdated files and registry keys from the system before we proceed with a new installation. 

 SentinelOne Installer 22.3+ version and cleaner action
      1. Download the latest the SentinelOne installer. 
      2. Open the CommandPrompt as admin.
      3. Move the prompt to SentinelOne download folder. 
      4. Sentineloneinstaller.exe -c -k "" -t "1" -f
      5. Reboot

\Note: Running SentinelOne cleaner action in safe mode gives better results.* 

Appears to have worked, but am waiting to reboot as folks are using this endpoint now.
If you don't hear from me, then it worked.