CrowdStrike_RTR_Powershell_Scripts VS omaha

Remote_Bitlocker_lock.ps1

You can sort of use RTR in a loop ( PSFalcon_Runscript_loop_PUBLIC.ps1 ) with script SET_ACL_FORCE_DELETE.ps1 .. I used this to snipe ~20 host when they came online to run cleanup script for malware:

RTR runs as SYSTEM so ... you may need to set perms etc ( https://github.com/freeload101/CrowdStrike_RTR_Powershell_Scripts/blob/main/SET_ACL_FORCE_DELETE.ps1)

Reference: https://github.com/freeload101/CrowdStrike_RTR_Powershell_Scripts/blob/a19018875096dd54f387356f08b56bccef0e276c/PSFalcon_Runscript_loop_PUBLIC.ps1#L157

https://github.com/freeload101/CrowdStrike_RTR_Powershell_Scripts Never done scale with this not sure what the MAX is for the run script job bucket thing ... let me know what you find. I ran on about 20 hosts no problem with this script. I would try just a echo "ALL DONE" script by 10's and see what happens ;P

This is actually a difficult problem. The general idea is that you can figure out where your application is installed, download a new version of it, and replace it. However in practice it is difficult to do in a way that works with various operating systems policies. For an example, you can see how Chrome manages this on windows https://github.com/google/omaha

You don’t opt-in to updates to Chrome and you will have one hell of a time opting out. If you’re on Windows, take a look at your task scheduler and notice that the Google Update task runs every hour in which it sends the current version of Chrome (stored in registry) to a Google URL and if that doesn’t match the latest then Google Chrome updates. You just need to restart your browser. Google update is a branded open source project called Omaha which is a very minimal and clever approach to application updates. Here’s the GitHub if you’re interested in learning more.

They use a fork of Omaha Updater for updates on Windows (I use Windows btw, it sucks)

Hi there. Chrome uses GoogleUpdate.exe to... er... update itself. GoogleUpdate is based on a project called Omaha. There is pretty good detail on how it works here. It might be as simple as force-running GoogleUpdate.exe with PowerShell to kickoff the update process.