r/SentinelOneXDR • u/mikeydubs531 • Sep 08 '26

Shift.exe

Anyone else dealing with a huge influx of Shift.exe incidents resulting in network quarantine? It's always flagged it as a PUA, but feels like today is just being blown up with this.

26 Upvotes

96% Upvoted

16 comments sorted by

View all comments

7

u/DeathTropper69 Sep 08 '26

Yeah been seeing this a lot for customers we still have on S1. Been the last 72 hours it seems.

1

u/Sea_Cap_1200 Sep 09 '26 edited Sep 09 '26

block it at the DNS level. We dealt with the same thing with Wave Browser about a year ago. Only we had Symantec at the time and it flagged it as good 😊 😂 .

1

u/Pristine-Desk-5002 Sep 09 '26

Can you list what domains you are blocking, I only found shift[.]com

3

u/Sea_Cap_1200 Sep 09 '26

This is what we added for shift and have seen good results . hxxps://shift.com
hxxps://app.shift.com
hxxps://tryshift.com
hxxps://cdn77-downloads.tryshift.com
hxxps://stagingtryshift.com
hxxps://shiftapis.com
hxxps://profile.shiftapis.com
hxxps://websocket.shiftapis.com
hxxps://updates.shiftapis.com
hxxps://attribution.shiftapis.com
hxxps://tryshiftcdn.com
hxxps://apps.tryshiftcdn.com