Capture Client Premier Administration Guide for Unified Management

Technical Documentation>  Remote Shell>  SentinelOne Remote Shell Use Case 2
Table of Contents

SentinelOne Remote Shell Use Case 2

  1. On endpoint:

    Go to start, open run and type - C:\Program Files

    Create a notepad file and name it as “calc.exe”

    Open CMD prompt and run REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "calc" /t REG_SZ /F /D "C:Program Files\calc.exe"

  2. On Remote shell terminal, run

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\run\calc" /f

Chat