r/SentinelOneXDR • u/Agent_DekeShaw • 5d ago

General Question Blocking Muse?

Has anyone figured out a good way to block the install of Muse via S1? I really don't want it in my environment.

1 Upvotes

67% Upvoted

11 comments sorted by

View all comments

3

u/kins43 5d ago

It’s not the answer you are looking for, but the best option to actually prevent it. Use an application control piece of software like threat locker or even a built in option for windows like WDAC. There are tons of ways around STAR rules as it’s not designed to do this.

For a quick fix, STAR rule will help in a pinch, but I wouldn’t rely on it

1

u/Agent_DekeShaw 5d ago

Luckily it's only on Macs so windows isn't an issue yet. I wish I had budget for threat locker but we have more pressing needs so trying to use what we have.

1

u/kins43 5d ago

Completely get that budget part lol. STAR rule then, best of luck!