Skip to main content

Fireeye (HX) Agent Removal

  • November 16, 2023
  • 3 replies
  • 134 views

Forum|alt.badge.img

Hi,

Do you have a working worklet for Fireeye agent removal? 

We have a batch file to remove the agent. Is there a way to create a worklet using a batch file?

Thanks

3 replies

JohnG-Automox
Forum|alt.badge.img
  • Automox Employee
  • 118 replies
  • November 16, 2023

Hi @FerOz ,

 

This is something the Automox Worklet Team can take a look at!

I will send you a DM to get some details and see what we can put together.

 

Have a great rest of your week!


Forum|alt.badge.img
  • Automox Employee
  • 129 replies
  • November 16, 2023

Howdy FerOz,

This has worked for me in the past, including yesterday with another client!

 

#cd is required only if the .bat file is already on the endpoint somewhere. If you have the .bat attached as a payload of the Worklet, just run the second command

cd "C:\your\custom\directory\"
   
.\mycustomscript.bat

 

The ā€˜.\ā€™ is required since Automox Worklets runs in 32-bit powershell. 


jack.smith
Forum|alt.badge.img+1
  • All Star
  • 168 replies
  • November 30, 2023

Iā€™d checkout the new WDK. Pretty powerful tooling here. 

 

The code could legit look like this

Get-Win32App | Where-Object {$_.Name -Match 'FireEye Endpoint Agent'} | Remove-Win32App

 


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings