Sentinel 3.4.2

Sentinel 3.4.2

Added

• Add bounded PE artifact observations for the marker pair in the supplied KGB RAT report, Windows Vault credential-read scope, and bounded loaded-user Policies Explorer Run/ms-settings/mscfile observations. These remain LogOnly; no live KGB sample detection or universal variant coverage is claimed.
• Query runtime process criticality on pinned termination handles and refuse critical/unknown targets. Guard sandbox tree response and installer agent shutdown; remove the MTP heuristic's direct process-kill bypass.

Fixed

• Remove the background scan's unconditional two-second wait for stable files, reduce per-file yielding, avoid duplicate hashing/old ADS bypass, invalidate metadata indexes after rule-version changes and skip directory junctions. Expose scan counters/elapsed time and keep unreadable paths incomplete.
• Move ETW handler work off the native callback using bounded owned payload copies. Report queue/byte usage, dispatch loss and stuck-handler time rather than equating thread liveness with progress. Protected-provider denial and historical loss remain explicit.
• Reorganize Overview around a small summary and collector issues. Move the roster to searchable/filterable Health & Metrics details with explicit legacy-browser controls, compact flex layouts, keyboard navigation, accurate event-window labels and honest checking/unverified status.

Validation and limits

• Product/shipping-test cross-build: zero warnings/errors. Selected portable regressions: 426 passed, seven native Windows fixtures skipped. Dashboard: 32 passed; Chromium preview checks at 960px/720px passed. Native Framework/IE, sustained load, real interrupted scans and representative malware detection require Windows validation. NanoAV source verification passes.
• See scope, references and validation. Marker matches do not authorize termination, criticality queries are not atomic crash-prevention guarantees, and the remaining standalone antivirus gaps are unchanged.