Skip to main content

Allowlisting the Liongard Agent in Antivirus & EDR Platforms

Updated over a week ago

🧩 Overview

Liongard recently implemented a major security enhancement to the Liongard Agent that introduces daily certificate rotation to strengthen supply-chain trust and align with Zero Trust principles.

During this transition, some environments—most notably those running SentinelOne—experienced service disruptions where legitimate Liongard binaries were flagged or quarantined due to the new certificate identity being treated as unknown.

At no point was the integrity or security of the Liongard Agent compromised.

This KB outlines why these detections occurred and—most importantly—how to properly allowlist the Liongard Agent in any antivirus/EDR platform using certificate-based exclusions.

⚙️ Executive Summary

  • Liongard transitioned from long-lived certificates to Microsoft-issued daily rotating certificates to reduce trust risk and eliminate long-term key exposure.

  • These short-lived certificates significantly improve security but caused certain EDR solutions—especially SentinelOne—to treat the signer identity as unfamiliar.

  • Because the Liongard Agent now changes its certificate and resulting file hash daily, hash-based allowlisting is no longer reliable or sustainable.

  • Partners must instead configure Certificate / Signer Identity allowlisting to prevent recurrence.

📘 Detailed Technical Analysis

1. The Trigger Event: Modernizing Trust

Liongard moved from static, annually renewed certificates to a High-Frequency Certificate Rotation model:

Previous Model

New Model

Certificate valid for 1–3 years

Daily certificate rotation

Easier for AV vendors to learn

Strong Zero Trust posture

Higher long-term key compromise risk

Minimizes certificate-based attack surface

This transition ensures no single certificate can be abused for long durations—dramatically improving overall security.

2. The Root Cause: Identity Change & Reputation Reset

Two factors triggered the false positives:

New Signer Identity

  • Liongard changed its signing provider from SSL.com to Microsoft.

  • SentinelOne classified the signer as “unknown,” leading to quarantines.

Daily Rotation

  • The certificate—and therefore the file hash—changes every 24 hours.

  • Allowlisting by hash becomes ineffective because:

    • Yesterday’s hash becomes invalid

    • Today’s agent has a new identity

    • Tomorrow’s agent will have yet another one

Result: Hash-based exclusions must be avoided.

3. Impacted Components

The following legitimate Liongard files were affected:

  • LiongardAgent.msi

  • LiongardAgentUpdater.exe

  • LiongardAgent.exe

🚨 Required Resolution: Certificate-Based Allowlisting

To ensure consistent, future-proof operation:

All partners must configure a Certificate / Signer Identity exclusion.
Hash-based exclusions will break daily and are no longer supported.

This certificate remains stable across all agent updates—even with daily rotation.

Required Certificate Details

Field

Value

Exclusion Type

Certificate / Signer Identity

Signer Name (Subject)

Liongard, Inc.

Issuer

Microsoft ID Verified CS EOC CA 01 or Microsoft Corporation (S1 version dependent)

Use these values in your AV or EDR platform’s Publisher or Certificate allowlisting configuration.

🔒 Guidance for Organizations Using SentinelOne

If your organization uses SentinelOne, you may need to adjust your console settings before configuring Certificate / Signer Identity allowlisting for the Liongard Agent.

Exclusion Interface Note

Some partners have reported that the newer SentinelOne interface hides certificate-based exclusion options unless the console is switched to the Legacy Exclusions experience.

To switch:

  1. Click your user dropdown in the upper-right corner of the SentinelOne console.

  2. Locate the “Exclusions Experience” option.

  3. Change it to “Legacy.”

This reveals the full certificate/signer identity exclusion configuration menu.


After switching to Legacy mode, you can proceed with creating the certificate-based exclusion using the Liongard certificate details provided above.

📈 Moving Forward: Liongard Process Improvements

Liongard is implementing several enhancements as part of this transition:

1. Deployment Guide Updates

  • Deployment KBs will emphasize:

    • Certificate-based allowlisting as the only supported trust method

    • Avoiding hash-based allowlisting entirely

2. Pre-Release Vendor Coordination

We are working with:

  • SentinelOne

  • CrowdStrike

  • Microsoft Defender

to ensure global reputation services pre-recognize our new Microsoft-issued certificate chain.

3. Improved Advanced Partner Communication

Major security architecture changes will include:

  • EDR configuration guidance

  • Clear migration steps

  • Expected behavior and remediation notes

Did this answer your question?