Sentinel 3.1.7

Sentinel 3.1.7

Added

• Embedded AntivirusLite engine — the standalone AntivirusLite.ps1 engine now runs in-process inside Sentinel.Agent via the Windows PowerShell 5.1 runtime (resolved from the GAC; nothing extra shipped). It runs on a background thread, so no powershell.exe child process is visible in Task Manager. Launched with -Embedded, which disables the Start-Job-based scanners and the scheduled-task auto-start; the file watcher, WMI exec monitor, scored C2 engine, and reverse-shell killer run in-process. The module is decoupled from Sentinel's response-policy pipeline and can be removed cleanly.

Fixed

• Self-kill prevention — the embedded engine was quarantining Sentinel.Service.exe and deleting Sentinel.Agent.exe, taking the agent down. The agent now passes its install directory via -SentinelDir; the engine treats that directory and the Sentinel process names as off-limits for every destructive action (quarantine, delete, C2 kill, reverse-shell kill, behavioral kill, WMI execution-block). Behavior toward everything outside the Sentinel install directory is unchanged — it remains kill-first.
• installer\build.bat — added the missing SentinelAutoRotate publish step that setup.iss requires, fixing the Inno Setup "Source file ... SentinelAutoRotate.exe does not exist" compile abort.

Validation and limits

• Agent and full solution build clean (0 warnings, 0 errors); the embedded script parses with 0 errors and ships inside the installer. In-process hosting was exercised directly (scan loop ran, no child powershell.exe, no background jobs).
• The end-to-end effect on an installed service — a full scan cycle with no QUARANTINED ... Sentinel.Service.exe / HARD DELETING ... Sentinel.Agent.exe lines in C:\ProgramData\Antivirus\av.log — remains a post-install Windows validation step.

Installer: SentinelSetup-3.1.7.exe (framework-dependent, requires .NET Framework 4.8). Run as administrator to upgrade over an existing install.