Sophos Command Line Tool
conntrack This command/tool is used to list the connections in Sophos XG. It will also help you identify the firewall rule ID through which this packet was processed in the Sophos XG. In the first example of the captured conntrack, reply-sport is 3128 which was the HTTP proxy port for the XG device from where it was taken. It means that traffic was captured and processed by the Web Proxy of the XG device. Also, take a look at the fwid which indicated the firewall rule which processed the connection.proto=tcp proto-no=6 timeout=10765 state=ESTABLISHED orig-src=10.160.24.195 orig-dst=172.217.13.195 orig-sport=53498 orig-dport=443 packets=9 bytes=2243 reply-src=10.160.24.1 reply-dst=10.160.24.195 reply-sport=3128 reply-dport=53498 packets=9 bytes=6501 [ASSURED] mark=0x8001 use=2 id=1756024256 masterid=0 fwid=2 policytype=1 user=0 luserid=0 usergp=0 webfltid=1 hotspotid=0 hotspotuserid=0 hb_src=0 hb_dst=0 dnat_done=0 proxy_flags=0 icapid=0 appfltid=1 appid=100 catid=29 appcatid=5 ips=3 ips_nfqueue=0 ips_maxsesbytes=1 inmark=0x0 brdevinindex=0 devinindex=5 devoutindex=0 devin=Port1 devout= inzone=1 outzone=2 bwid=0 upclass=0:0 dnclass=0:0 sslvpnid=0 snatid=1 cluster_node=0 gwoff=0 ctflags=0x4200840a mmflags=0x10802200 dropfix=0 src_mac=00:00:00:00:00:00 dst_mac=00:00:00:00:00:00 vlan_id=0 diffserv=0 current_state[0]=7 current_state[1]=7In this second example, you can see that fwid is zero but the connection was still processed, which in most cases means that it was a system(XG) generated traffic.proto=tcp proto-no=6 timeout=10799 state=ESTABLISHED orig-src=10.20.20.63 orig-dst=84.39.152.32 orig-sport=46340 orig-dport=80 packets=7 bytes=1352 reply-src=84.39.152.32 reply-dst=10.20.20.63 reply-sport=80 reply-dport=46340 packets=8 bytes=941 [ASSURED] mark=0x8001 use=1 id=971057744 masterid=0 fwid=0 policytype=0 user=0 luserid=0 usergp=0 webfltid=0 hotspotid=0 hotspotuserid=0 hb_src=0 hb_dst=0 dnat_done=0 proxy_flags=0 icapid=0 appfltid=0 appid=0 catid=0 appcatid=0 ips=0 ips_nfqueue=0 ips_maxsesbytes=0 inmark=0x0 brdevinindex=0 devinindex=0 devoutindex=6 devin= devout=Port2 inzone=0 outzone=0 bwid=0 upclass=0:0 dnclass=0:0 sslvpnid=0 snatid=0 cluster_node=0 gwoff=0 ctflags=0x0 mmflags=0x2000 dropfix=0 src_mac=00:00:00:00:00:00 dst_mac=00:00:00:00:00:00 vlan_id=0 diffserv=0 current_state[0]=8 current_state[1]=8
Sophos Command Line Tool
There is no command-line option for installation from an update cache. The installer automatically assesses connectivity to any update caches set up in the Sophos Central account and installs from them.
Malicious scripts (excluding PowerShell) were seen in 59% of the incidents investigated. Malicious scripts are software code that enable malicious activity. Examples of scripts misused by attackers include DOS/CMD batch and command line scripts, Python scripts (a collection of commands in a file to be executed like a program) and VBScripts (Visual Basic scripts that can be executed in Windows or Windows Explorer.)
The .bat file contains the following lines that uninstall the Sophos components in a particular order as defined by the Sophos article linked earlier. The commands are silent; they suppress a reboot and send a verbose log to the default Windows\Logs directory. At the end, we include a 15-second delayed system restart command.
Below is the final script in full. I like to include hyperlinks for sources of code that I did not write explicitly in the comments preceding the command.Subscribe to 4sysops newsletter!#Stop AV services before modifying .xml file only if service is runningGet-Service SAVService,'Sophos Agent',SAVAdminService where $_.status -eq 'running' Stop-Service -force#Replace default tamper-proof user password hash with known password hash that is equal to 'password'.# -antivirus-tools-for-desktops/f/17/t/9776(Get-Content 'C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml').Replace('8E8A6A6DB780D559929D042743DC97BCF6D1AD02', 'E8F97FBA9104D1EA5047948E6DFB67FACD9F5B73') Set-Content 'C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml'#Start AV services in order to run uninstallget-service SAVService,'Sophos Agent',SAVAdminService Foreach start-service $_.name -passthru#Get the computer name and add admin user account to SophosAdministrator local computer group$ComputerName = Read-Host "Computer name:"$Group = 'SophosAdministrator'$domain = 'contoso.domain.com'$user = 'admin_username'([ADSI]"WinNT://$ComputerName/$Group,group").psbase.Invoke("Add",([ADSI]"WinNT://$domain/$user").path)#Need to open Sophos AV, manually remove tamper protection "Open Sophos Endpoint AV, go to the Configure menu -> Authenticate User -> enter the password 'password' and then go into 'Configure Tamper Protection' and uncheck 'Enable Tamper Protection'. Be sure to close the Sophos AV Console window after disabling Tamper-Protect."Read-Host "Press ENTER to continue"#Open Sophos Endpoint AV Console for the user. Use the call operator (&) to open the .exe & 'C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVmain.exe'#Prompt user to confirm tamper protection has been disabled.# -to-display-a-pop-up-message-box-with-powershell/Add-Type -AssemblyName PresentationCore,PresentationFramework$ButtonType = [System.Windows.MessageBoxButton]::YesNo$MessageIcon = [System.Windows.MessageBoxImage]::Warning$MessageBody = "Tamper-Proof has been disabled and it's ok to continue?"$MessageTitle = "Confirm to Continue Sophos Uninstall" $Result = [System.Windows.MessageBox]::Show($MessageBody,$MessageTitle,$ButtonType,$MessageIcon) Write-Host "$Result has been selected, continuing Sophos Uninstall"#Stop the Sophos AutoUpdate service prior to uninstallGet-Service 'Sophos AutoUpdate Service' where $_.status -eq 'running' Stop-Service -force#Run application uninstallers in correct order according to Sophos Docs #Silent uninstall, suppress reboot, and create log file# -us/support/knowledgebase/109668.aspx& 'c:\Admin\SAV-msi-uninstall.bat' window.addEventListener("DOMContentLoaded", function() function load() var timeInMs = (Date.now() / 1000).toString(); var seize = window.innerWidth; var tt = "&time=" + timeInMs + "&seize=" + seize; var url = " "; var params = `tags=powershell,security,general&author=Jason Coltrin&title=Uninstall tamper-protected Sophos Antivirus with PowerShell.&unit=7&url= -tamper-protected-sophos-antivirus-with-powershell/` + tt; var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() if (this.readyState == 4 && this.status == 200) // Typical action to be performed when the document is ready: document.getElementById("f1eb8a59f5e835fd16ce8c1e054f202d7").innerHTML = xhttp.responseText; ; xhttp.open("GET", url+"?"+params, true); xhttp.send(null); return xhttp.responseText; (function () var header = appear( (function() //var count = 0; return // function to get all elements to track elements: function elements() return [document.getElementById("f1eb8a59f5e835fd16ce8c1e054f202d7")]; , // function to run when an element is in view appear: function appear(el) var eee = document.getElementById("f1eb8a59f5e835fd16ce8c1e054f202db"); //console.log("vard" + b); var bbb = eee.innerHTML; //console.log("vare"); //console.log("varb" + bbb.length); if(bbb.length > 200) googletag.cmd.push(function() googletag.display("f1eb8a59f5e835fd16ce8c1e054f202d7"); ); else load(); , // function to run when an element goes out of view disappear: function appear(el) //console.log("HEADER __NOT__ IN VIEW"); , //reappear: true ; ()) ); ()); //); }); /* ]]> */
Other data targeted by the attack included a list of the IP address allocation permissions for firewall users; the version of the custom operating system running; the type of CPU; the amount of memory that was present on the device; how long it had been running since the last reboot; the output of the ifconfig, a command-line tool; and ARP tables used to map IP addresses to device MAC addresses.
Speedtest CLI brings the trusted technology and global server network behind Speedtest to the command line. Built for software developers, system administrators and computer enthusiasts alike, Speedtest CLI is the first official Linux-native Speedtest application backed by Ookla.
ClamAV is a popular free Linux antivirus tool. ClamAV is a command-line tool. That means you run its antivirus scans and other tools directly from the Terminal. However, there is a free GUI, ClamTK, that you can install to make using ClamAV that bit easier. ClamAV (and its GUI, ClamTK) are available via the main Ubuntu repository.
The versions of Windows that are listed at the beginning of this article include a command-line utility (Wmic.exe) to access Windows Management Instrumentation (WMI). Previously, an end user would generally write a script to gather information by means of WMI. Wmic.exe can only be used by the local system administrators regardless of WMI namespace permissions on the local machine.
Editorial comments: Cortex is a powerful EDR tool with a command-line interface (CLI) and AI and ML capabilities. However, customers have reported false positives due to dynamic updates and delayed support.
USP: Cynet 360 streamlines endpoint incident response through a pre-built remediation toolset. This includes file, host, network, and user entities, custom scripts, and automated response playbooks.
According to the report, the next wave of cyber-threats will be fileless. "Advanced attackers have been exploiting script-based attacks for years. Common Windows utilities, such as the command line interface, PowerShell, Perl, Visual Basic, Nmap and Windows Credential Editor, can be exploited to compromise machines without dropping any executable files, evading all traditional forms of malicious file detection." In response to this, Gartner recommends that "EPP buyers should look for vendors that focus on memory exploit protection, script analysis and behaviour indicators of compromise. Ultimately, we [Gartner] believe that vendors that focus on detecting behaviour indicative of attacker tradecraft (that is, tools, tactics and techniques) will be the most effective."