Automox Developer Resources

Dev Hub

478 Topics

jack.smith
jack.smithAll Star
posted in Community Worklets

Office for Mac Update Package

Sometimes Microsoft Autoupdate is not recognize when office Office for Mac is not patched. This worklet is more of a work around than a solution, so take it for what its worth. This does require someone to update the version and link each new Office for Mac release to match this site https://docs.microsoft.com/en-us/officeupdates/update-history-office-for-mac The worklet will detect when Office for Mac is not at the desired version and then download the patch from Microsoft and install. Evaluation Code #!/bin/bash ver="$(mdls '/Applications/Microsoft Excel.app' | grep Version | sed -e 's/[[:alpha:]([:space:],",:,=,^-]//g')" if [[ $ver == "16.44" ]];then echo "Complaint $ver detected" exit 0 else echo "Non-Compliant $ver detected" exit 1 fi Remediation Code ver="$(mdls '/Applications/Microsoft Excel.app' | grep Version | sed -e 's/[[:alpha:]([:space:],",:,=,^-]//g')" echo "$ver detected. Attempting to run installer." curl -o /tmp/Microsoft_Excel.pkg 'https://officecdn.microso

1
D
2 years ago
NickCo-Automox
NickCo-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Disable LLMNR (Security Risk) - Windows

Hi Automox Alive Community! LLMNR stands for Link-Local Multicast Name Resolution and is a favorite vector among pen-testers and malicious threat actors for conducting man-in-the-middle attacks. Don’t take my word for it though, a quick google shows the prevalence of articles discussing the impact and risk associated. As a result, I’ve decided to create a worklet for state toggle concerning this issue for Windows. Evaluation: ############################################# $regPath = "HKLM:\Software\policies\Microsoft\Windows NT\DNSClient" $regProperty = "EnableMulticast" $desiredValue = '0' ############################################# # Compare current with desired and exit accordingly. # 1 for Compliant, 0 for Non-Compliant try { # Retrieve current value for comparison $currentValue = (Get-ItemProperty -Path $regPath -Name $regProperty -ErrorAction Stop).$regProperty } catch [Exception]{ write-output "$_.Exception.Message" exit 1 } if ($currentValue -eq $desiredValue) { # al

1
AdamW-Automox
2 years ago
Gary
Gary
posted in Community Worklets

Worklet: Enable FileVault on MacOS and add recovery key to tag

The following worklet will enable FileVault on Macs and save the recovery key into Automox. To avoid requesting credentials from the user it has been set to enable at the next login. The recovery key will be written to a tag in Automox the next time the worklet runs following FileVault being enabled. Evaluation: #!/bin/bash # # Check if FileVault is enabled if ($(fdesetup isactive)); then echo "FileVault is enabled!" exit 0 fi exit 1 Remediation: #!/bin/bash #Created by Gary Langley #02/12/2020 # # Check if FileVault is enabled or current user is System if ( $(fdesetup isactive) && [ ! -f "/Users/Shared/Automox/filevault.plist" ] ); then echo "FileVault is already enabled!" exit 0 fi # Enable Filevault and get Recovery Key fdesetup enable -defer /Users/Shared/Automox/filevault.plist -forceatlogin 3 -dontaskatlogout # Use Python to parse JSON output from API and return values required for the PUT request python2 -c ' import urllib2 import json import socket import plis

0
Gary
2 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Community Worklets

Worklet: Remediation for CVE-2018-8581

This is a remediation for CVE-2018-8581 per this article: https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2018-8581 The workaround is to remove a specific registry entry, which this worklet does: Evaluation code: Exit 1 Remediation code: reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v DisableLoopbackCheck /f Note that the above code is the CMD syntax and not Powershell, but that should run fine. If you run into any problems you can convert the above line into Powershell pretty easily.

0
Nic-Automox
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in API & Integrations

Powershell script to move devices that have been disconnected longer than X days to a group

So you want to audit your devices that haven’t been connected for a long time, but you’re not prepared to delete them yet and just want to move them to their own group? Currently you can do this on the devices page by sorting by Last Disconnected Date and selecting devices to Assign to Group. However, this can become unwieldy if you have pages and pages of devices to move. This script automates the move using an API call to check the last disconnected date and move any devices older than the number of days you specify in the code. There are five areas in the code you’ll need to update to get the script to function: $orgID = 'YOUR_ORG_ID' - put your Org ID, which can be found by looking at the URL of your console and selecting the value after the “?o=”: https://console.automox.com/dashboard?o=999999 . In this example URL the Org ID is the 999999 portion. $apiKey = 'YOUR_API_KEY' - in your console, go to Settings->API and select the API key. Note that the API key is per admin u

1
R
2 years ago
T
TechieOneKenobiRookie
posted in Community Worklets

Worklet to remove Zoom

Evaluation Code: if(test-path -Path "%APPDATA%/Zoom"){Exit 1} Remediation Code: $process = Start-Process -File-Path "%APPDATA%\Zoom\Zoom\uninstall\Installer.exe" -ArgumentList "/uninstall" -PassThru Exit $process.ExitCode

4
Nic-Automox
2 years ago
T
TechieOneKenobiRookie
posted in Community Worklets

Enable RDP

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f I push this if I need to enable RDP for some reason.

0
T
2 years ago
N
ncarawayRookie
posted in Community Worklets

Worklet: Add SNMP Service

Evaluation: if (Test-Path -Path "C:\Windows\System32\SNMP.exe") { Exit 0 } else { Exit 1 } Remediation Code: Install-WindowsFeature SNMP-Service Start-Sleep -s 10 Restart-Service -name SNMP Note: The Start-Sleep and Restart-Service seem to help in making sure the snmp service has enough time to install and make sure the service gets started after the install. The snmp service will only be added if it is not already on the system.

0
N
2 years ago
jack.smith
jack.smithAll Star
posted in Community Worklets

Windows Security Worklet - NTLM, SMB, NetBIOS, CredSSP and Unquoted Search Path

One way to minimize the number of policies was to build a worklet that I’m using to apply security baseline changes to workstations. More importantly I’m using multiple PowerShell functions to control output to obtain a cleaner looking activity details when a host runs the worklet. Each configuration change was a result of either a vulnerability scanner or baseline requirement. I’ve attempted to remember to put links in where applicable in the code. Evaluation Code # Security Team Workstation Configuration Baseline Evaluation Code #region Rapid7 Vulnerability: Weak LAN Manager hashing permitted Function Test-LMCompatibilityLevel { # Network security: LAN Manager authentication level # https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj852207(v=ws.11) $path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $ntlm = Get-ItemProperty -Path $path -Name LmCompatibilityLevel -ErrorAction SilentlyContinue $compliant = switch ($

0
jack.smith
2 years ago
BustaBubz11
BustaBubz11Rookie
posted in Community Worklets

Task Scheduler

I’m glad you guys do things like this it’s awesome. At my company we like to do a weekly restart for all machines on Friday at midnight besides our Police Department for the obvious reasons just so things continue to run smoothly and how we’ve set that up is through SCHTASKS. schtasks /create /sc weekly /d FRI /tn "auto reboot computer weekly" /st 24:00 /tr "shutdown -r -f -t 10"

0
BustaBubz11
2 years ago
T
taranbir.singhNovice
posted in Community Worklets

Upgrade the CIFS authentication method- Windows

This worklet can be used to remediate vulnerability found by Rapid7 -Weak LAN Manager hashing permitted. We do it by adding a value in registry. Evaluation Code: Exit 1 Remediation Code $path = ‘HKLM:\SYSTEM\CurrentControlSet\Control\Lsa’ $key = try { Get-Item -Path $path -ErrorAction Stop } catch { New-Item -Path $path -Force } New-ItemProperty -Path $key.PSPath -Name LMCompatibilityLevel -Value 5

0
T
2 years ago
AdamW-Automox
AdamW-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Disabling Root Login on Linux Devices

Hey Y’all! Disabling root login is a super easy trick to increase security on Linux devices. In a lot of cases, IT admins set the root password as something simple so they remember it easily as they use it often to access a device via SSH . Furthermore, attackers typically use the root credential when trying to gain access to your device. For this reason and more disabling root login and create root privilege users is a good security practice. The Worklet below is designed to evaluate your device to ensure Root Login is disabled. Note: you need to make sure the users you’ve created on this device have sudo privileges. This Worklet currently only support devices running CentOS. Check later as this script will be modified to support other linux distros Evaluation: #!/bin/bash # create alias to the desired root login value for evaluation. this is the value you are looking for. ssh_value="^PermitRootLogin yes" # check the current conf file on the device to compare to desired value fo

4
AdamW-Automox
2 years ago
R
Reuben_FRookie
posted in Community Worklets

Basic Windows L2TP VPN Worklet

This is a very basic method of setting up an L2TP VPN using a worklet. Change the values: vpnName, serverAddress, yourPsk, authMethod Evaluation Code: Get-VpnConnection -Name "vpnName" Remediation Code: Add-VpnConnection -AllUserConnection -Name "vpnName" -ServerAddress "serverAddress" -TunnelType L2tp -EncryptionLevel Optional -L2tpPsk "yourPsk" -AuthenticationMethod authMethod -Force

4
NickCo-Automox
2 years ago
Maikel
MaikelChannel Partner
posted in Community Worklets

Worklet to remove all java versions

Simple worklet to remove all java versions and write back in activity log. Worklet is maintained on our github page: https://github.com/Dutch-Technology-eXperts/Automox/blob/main/remove_java.ps1 Evaluation code: Exit 1 Remediation code: IF (gwmi Win32_Product -filter "name like 'Java%'") { [void](gwmi Win32_Product -filter "name like 'Java%'" | % { $_.Uninstall() }) if ($? -eq "True") { Write-Output "Java succesfully removed." } else {Write-Output "Failed to remove Java!" } } ELSE {Write-Output "Java not installed."}

0
Maikel
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Uninstall Malwarebytes from Windows

This worklet downloads the latest version of the Malwarebytes Support Tool and runs it on the system to uninstall Malwarebytes. If you want to save the tool to a directory other than C:\Temp, modify $uninstallFile on line 1 of the remediation code. From Malwarebytes: The Malwarebytes Support Tool command line version is used to cleanup and remove Malwarebytes products. The Support Tool removes Malwarebytes Endpoint Security and Malwarebytes Endpoint Protection, including their files, settings, and license information. Note : The Malwarebytes Support Tool cannot uninstall Malwarebytes software if the Tamper Protection feature is enabled in your environment. Disable Tamper Protection before running this tool. Evaluation: <# .SYNOPSIS Check for presence of specified application on the target device .DESCRIPTION Read 32-bit and 64-bit registry to find matching applications Exits with 0 for compliance, 1 for Non-Compliance. Non-Compliant devices will run Remediation Code at t

0
Tony-Automox
2 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in API & Integrations

About the Automox Labs category

API Scripts and other cool Automox tricks

0
Nic-Automox
2 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in API & Integrations

Dynamic Groups Worklet Workaround API Script (runs multiple RSP & worklet policies against a list of devices)

This script will let you run an arbitrary number of required software policies or worklets against a list of devices exported from the Devices page, in essence giving you a workaround to implement a dynamic group functionality. Go to your devices page and filter for the devices you’d like to run the policies against. Click the select all box to select all of those devices. Click Export which will save a csv file that contains one line per device, named automox-devices.csv. Replace YOUR_API_Key with a valid API key from your console. Replace YOUR_ORG_ID with the orgID for your console (you can get this from the browser URL for your console: look for the o=1234 portion and that 1234 is your orgID). Replace PolicyID1,PolicyID2,PolicyID3,PolicyID4,PolicyID5,etc… with a list of the policies you want to run, each one separated by a comma. To find the PolicyIDs, edit the policy you wish to include and look for the pid=123456 in the URL. That 123456 is the Policy ID that you’ll put in the l

0
Nic-Automox
2 years ago
Maikel
MaikelChannel Partner
posted in Community Worklets

Check if java is installed and running

Since the beginning of time we see java being installed by default. With the changing license structure of Oracle and the monthly increase in java vulnerabilities it is time to reduce the java footprint to the bare minimum. this worklet does a simple check if Oracle Java or Amazon Corretto is installed and if so checks if there is a running JAVA process to help determine if JAVA is needed on that system or if it can be removed. Evaluation Code EXIT 1 Remediation Code $installed = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where { $_.DisplayName -Match "Java" -or $_.DisplayName -match "Corretto" }) $version = "(Vendor: " + $installed.Publisher + " " + "Version: " + $installed.DisplayName + ")" If(-Not $installed) { Write-Output "Java is not installed" EXIT 0 } else { IF (Get-Process -Name "java" -ErrorAction SilentlyContinue) { Write-Output "$version is installed and currently running." } else { Write-Output "$version installe

1
D
2 years ago
M
Melvin_Luijten
posted in Community Worklets

Worklet: Create a Rapid7 InsightIDR/InsightOPS logging.json file

The insight agent from Rapid7 insightIDR and InsightOPS supports advanced configuration features which can be configured by placing a logging.json file in the config folder of the agent. Distribution of this config file is not handled by Rapid7 therefore Automox can be used to place the file on all applicable systems. The content of the logging.json file can be tweaked based on your own preferences. Documentation can be found here: https://docs.rapid7.com/insight-agent/insightops#windows Don’t forget to add your API key before using the worklet. if ($configcheck -eq "True") {Write-Output "logging.json already exists" exit 0} New-Item "C:\Program Files\Rapid7\Insight Agent\components\insight_agent\common\config\logging.json" Set-Content -Path "C:\Program Files\Rapid7\Insight Agent\components\insight_agent\common\config\logging.json" -Value '{ "config": { "name": "insight agent windows", "endpoint": "eu.data.logs.insight.rapid7.com", "region": "eu", "api-key": "PL

0
M
2 years ago
jack.smith
jack.smithAll Star
posted in Community Worklets

Windows - Notify User with Balloon Tip Pop-up

Displays a balloon tip from the task tray for about 8 seconds for currently logged in user. Would invite anyone to help me get this code further! Worklet does use a custom icon file that I include as a file in the worklet. #message $msg = 'Hello world.' $title = 'Company' $icon = 'C:\Users\Public\Pictures\company.ico' IF(!(Test-Path "$icon")){Copy-Item company.ico "$icon"} # Build script that will send message. VBS is used to hide the PowerShell Script from popping up $vbs = @" command = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -File C:\ProgramData\Amagent\message.ps1 -Force" set shell = CreateObject("WScript.Shell") shell.Run command,0 "@ New-Item -Path "c:\ProgramData\Amagent" -Name "message.vbs" -ItemType "file" -Value $vbs -force $script = @" `$BalloonTipText = ("$msg") `$BalloonTipTitle = "$title" `$BalloonTipTime = 1000 `$BalloonTipIcon = 'None' Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Sy

4
jack.smith
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Datadog Configuration Set in Windows

This worklet takes two configurations that you upload to the worklet - eventlogs.yaml & default_agent_config.yaml - and copies them to the Datadog folders they belong to as conf.yaml and datadog.yaml respectively. It also takes an existing conf.yaml.default configuration and makes a copy of it as the conf.yaml file in its’ same directory. A log is created in the Automox activity log, but it also creates a log locally on the machine in C:\vSOC_Tools. Evaluation: Exit 0 Remediation: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $datadogConfDir = 'C:\ProgramData\Datadog\' $win32ConfDir = 'C:\ProgramData\Datadog\conf.d\win32_event_log.d\' $diskConfDir = 'C:\ProgramData\Datadog\conf.d\disk.d' $eventLogs = 'eventlogs.yaml' #Uploaded File $defaultAgent = 'default_agent_config.yaml' #Uploaded File $service = Get-Service -Name "Datadog Agent" -ErrorAction SilentlyContinue Start-Transcript -Path C:\vSOC_Tools\test.log # Create directories if they don'

0
Tony-Automox
2 years ago
D
DavidM-AutomoxFormer Automox Employee
posted in Community Worklets

Uninstall Flash Player - Windows

As you probably have already heard endlessly, Adobe Flash Player will reach end of life on December 31 2020. https://www.adobe.com/products/flashplayer/end-of-life.html Adobe has provided an uninstaller that works fairly well to remove stand-alone installations of Flash Player. https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html Please note the information in RED at the top of the uninstall directions: These instructions are NOT applicable to Flash Player included with Microsoft Edge or Internet Explorer on Windows 8 and later or with Google Chrome on all supported operating systems. Please visit the Flash Player Help page for instructions on enabling (or disabling) Flash Player in various browsers. “Most” modern browsers have built-in Flash support. Managing that integration is not in scope for this Worklet (as that topic would better be covered on how to manage Flash per browser. It is disabled by default in most of these browsers, and can be managed with

2
D
2 years ago
H
Hunter_Klein
posted in Community Worklets

Installing the Arctic Wolf Agent via Automox

Installing the Arctic Wolf Agent Recently we had to go about deploying an agent from a managed SOC called “Arctic Wolf” to all of our server endpoints. The trouble is, the MSI file had to be in the same directory as a “customer.json” file in order to work. This was an issue because Automox only allows you to upload the MSI. Luckily, with PowerShell your imagination is the limit. This is how we got around the limitation as the “customer.json” file is a rather small (one line) file and can be created at runtime with PowerShell. Create a Required Software policy for Windows Upload the MSI to Automox Set the Package Name and Package Version to how it appears in the Win32_Product WMI class when installed on a machine. This is how Automox determines if the package is installed and if a machine is compliant. Currently as of writing this, the name is Arctic Wolf Agent 2020-05_01 and the version is 20.20.0501. Use the following PowerShell syntax to install the software, replacing the customerU

8
Ariel-Automox
2 years ago
J
JHagstromPro
posted in API & Integrations

Script | Export all applied patches from all company machines to CSV

Hello! Thought I would share this API script I wrote that exports all applied patches on all machines to a CSV. UseCase: For audits this allows an easy way to export every single patch on a machine to prove that machines have been patched during a time period. Notes: This is meant to be run on a machine NOT through a worklet. Make sure to add in your own API Key for this to work. For a full list of objects you can pull from the API see Automox API Documentation under “Response”. This script is not perfect. If run multiple times it will keep adding to the same CSV, so make sure to either clear the CSV and save or just delete it. Powershell Code: #Set Execution policy to allow for 3rd party modules Set-ExecutionPolicy Unrestricted -Force #Define API Key and URL to get initial Machine list $apiKey = "*INSERT YOUR API KEY HERE*" $apiUrl = "https://console.automox.com/api/servers/" $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add("Authorizatio

0
J
2 years ago
Tony-Automox
Tony-AutomoxAutomox Employee
posted in Community Worklets

Worklet: Install Notepad++ for Windows

Download the version of Notepad++ you want to install, upload it to the worklet, and set $saveFile in the remediation to match the name of the file you upload. Evaluation: <# .SYNOPSIS This Test script checks to see if an application is installed .DESCRIPTION This script queries the installed files for 64bit software and returns a 0 if product is installed or 1 if not .Notes File Name :App_Install_Test.ps1 Author :Automox Prerequisite :PowerShell V2 over Win7 and later #> #Handle Exit Codes: trap { $host.ui.WriteErrorLine($_.Exception); exit 90 } function App_Install_Test { <# .SYNOPSIS This function Checks to see if app is installed on system or not . .DESCRIPTION After checking the app availability, based on the exit code tool will decide to call remediation code or not. #> ## Name of the desired application ## $appName = 'Notepad' ## You must also hard-code the app name in the $scriptblock be

0
Tony-Automox
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings