SentinelSuperProAutomaticProtectionv641Safenet

Hunt Hypothesis

This rule detects the presence of SentinelSuperPro Automatic Protection software, a commercial endpoint security tool that may be deployed by adversaries to hide malicious activity or by legitimate users to secure sensitive data. Proactively hunting for this signature allows the SOC team to verify the expected inventory of endpoint protection agents and identify unauthorized installations that could serve as a vector for fileless malware or data exfiltration.

YARA Rule

rule SentinelSuperProAutomaticProtectionv641Safenet
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 [4] 55 8B [3] 85 C0 74 ?? 85 ED 75 ?? A1 [4] 50 55 FF 15 [4] 8B 0D [4] 55 51 FF 15 [4] 85 C0 74 ?? 8B 15 [4] 52 FF 15 [4] 6A 00 6A 00 68 [4] E8 [4] B8 01 00 00 00 5D C2 0C 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An administrator manually updates the Sentinel SuperPro Automatic Protection client on a domain controller or file server using the standalone installer (SentinelSuperProAutomaticProtectionv641Safenet.exe or similar naming convention) during a maintenance window.

  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe/powershell.exe initiated by a user with the “Domain Admins” or “Server Admins” group, AND the working directory is a known software installation path (e.g., C:\Program Files\Sentinel\ or C:\Temp\).

• Scenario: A scheduled task or Group Policy Object (GPO) software deployment pushes the Sentinel SuperPro Automatic Protection update to multiple endpoints simultaneously, causing the executable to run from a network share or a temporary staging folder (e.g., \\fileserver\swdist\ or C:\Windows\Temp\).

  • Filter/Exclusion: Exclude instances where the executable path contains \\ (indicating a network share) or resides in standard temporary directories (C:\Windows\Temp\, C:\Users\*\AppData\Local\Temp\) AND the parent process is svchost.exe (specifically the NetworkSvc or DcomLaunch service) or wuaexhost.exe (Windows Update Agent).

• Scenario: A legacy application or service that relies on Sentinel licensing requires the Automatic Protection service to restart or re-initialize its license check, spawning the executable from a non-standard service directory (e.g., C:\Program Files (x86)\LegacyApp\Bin\).

  • Filter/Exclusion: Exclude processes where the parent process is services.exe or svchost.exe (specifically the LocalService or NetworkService