
CVE-2021-36934 (HiveNightmare aka. SeriousSam) 탐지 및 완화 스크립트
.\Get-HiveNightmareStatus.ps1
.\Get-HiveNightmareStatus.ps1 -PostureCheck
# For initial SAM fixes and vss removal
.\Get-HiveNightmareStatus.ps1 -Remediate
# Remediate even if the checks say healthy or are partial
.\Get-HiveNightmareStatus.ps1 -Remediate -Force
.\Get-HiveNightmareStatus.ps1 -Exploit
sentinelone-policy-override.txt의 정책 오버라이드를 적용합니다.(.\sentinelctl.exe config | Select-String -Pattern "vssSnapshots|penetration")를 사용하여 정책이 적용되었는지 확인합니다.$ (.\sentinelctl.exe config | Select-String -Pattern "vssSnapshots|penetration")
agent.enginesWantedState.penetration off
agent.vssSnapshots false