We’re aware of an issue impacting environments where the SentinelOne agent has been upgraded from version 25.1 to 25.2.
In some cases, the updated SentinelOne agent (v25.2) is incorrectly identifying components of the older agent as malicious, specifically flagging them as ransomware activity.
This is a false positive and is not indicative of an actual threat in the environment.
- Alerts may be generated unnecessarily, creating noise for SOC and operations teams
- In certain scenarios, this could trigger automated responses depending on policy configuration
Current status
A fix for this behaviour has been identified and is planned for an upcoming SentinelOne agent release.
Recommended workaround
Until the fix is available, we recommend implementing a policy-level override to suppress these false positive detections.
- Apply the recommended policy exception to prevent alert creation for these specific detections
- Ensure this is scoped appropriately to avoid impacting broader detection coverage
👉 Refer to this article for step-by-step guidance on creating the policy override:https://me.n-able.com/s/article/SentinelOne-Agent-causing-Boot-Loop-during-Upgrade-from-Version-25-1-to-25-2
What you should do
- If you are running agent version 25.2 and observe ransomware alerts linked to SentinelOne files, treat these as false positives in this context
- Apply the recommended policy exception as a temporary mitigation
- Continue to monitor release notes for the upcoming fix
If you run into issues or need help applying the workaround, please reach out to Support.