Fireeye (HX) Agent Removal

FerOz

November 16, 2023 at 1:16 am UTC

#Worklets#fireeye

Hi,

Do you have a working worklet for Fireeye agent removal?

We have a batch file to remove the agent. Is there a way to create a worklet using a batch file?

Thanks

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (3)

JohnG-AutomoxNovember 16, 2023

Hi @FerOz ,

This is something the Automox Worklet Team can take a look at!

I will send you a DM to get some details and see what we can put together.

Have a great rest of your week!

MarkH-AutomoxNovember 16, 2023

Howdy FerOz,

This has worked for me in the past, including yesterday with another client!

powershell5 lines

#cd is required only if the .bat file is already on the endpoint somewhere. If you have the .bat attached as a payload of the Worklet, just run the second command

cd "C:\your\custom\directory\"
   
.\mycustomscript.bat

The ‘.\’ is required since Automox Worklets runs in 32-bit powershell.

jack.smithNovember 30, 2023

I’d checkout the new WDK. Pretty powerful tooling here.

https://community.automox.com/product-updates-4/the-automox-worklet-development-kit-is-live-now-2245

The code could legit look like this

powershell1 line

Get-Win32App | Where-Object {$_.Name -Match 'FireEye Endpoint Agent'} | Remove-Win32App

Back to all discussions