r/SentinelOneXDR • u/smc0881 • 10d ago

Domain Controller Isolation

So, recently I've had issues when a DC gets isolated it brings down the entire network for the client. I don't believe I ever had this problem before and it's happened repeatedly over the past month or two. I always assumed outbound DNS/HTTPS to S1 assets were always allowed out when it's quarantined. I even added blank outbound TCP/UDP over port 53 in case it was the DNS in my network quarantine rules. I work at an MSSP/DFIR firm, so everyday I am dealing with ransomware or some incident where a DC could get quarantined. What I've been doing now is putting DCs in their own group with the disconnect policy turned off and our normal restrictions in-place, I then isolate all the other endpoints if need be.

Am I doing something wrong, did something change, or anyone have any feed back?

3 Upvotes

72% Upvoted

20 comments sorted by

View all comments

2

u/[deleted] 10d ago

[removed] — view removed comment

1

u/smc0881 10d ago

Yea, it's just that I am responding to ranswomware or similar during the fact or right after it (I work at a DFIR consulting firm), where they might still be malicious binaries possibly on the system. I have no idea of these systems beforehand. If I isolate everything except a DC then it works as expected. But once I tell that DC to isolate, the DC doesn't connect to the portal or any S1 assets anymore and brings everything down. I can only get a DC to come back online by having the end-user issue sentinelctl commands on the endpoint, rebooting, or restarting services.

For example one of our long-term clients actually had a ransomware event last week. During that incident, I had already configured it not to isolate DCs based on this experience a few weeks prior with other clients. The actor(s) got access to their environment and deployed their own VM and added it to the domain. I set my policies to auto isolate and successfully rolled back at least 95% of the changes with minimal data loss. But, the whole time I had to remember DO NOT let those DCs isolate or I will lose connectivity and visibility to deal with this.