Removing an entire, non-empty directory [Linux]

[jkozlowicz]

Hi,
I would like to batch-delete the same directory on multiple hosts.

The following works on Windows:
base_command='rm', command='rm {directory} -force'

but it doesn't on Linux. I also tried the following options on Linux:
base_command='rm', command='rm {directory} -force'
base_command='rm', command='rm -rf {directory}'
base_command='rmdir', command='rmdir {directory}'
base_command='rmdir', command='rmdir -rf {directory}'
base_command='rmdir', command='rmdir {directory} -force'

and none of the above worked. I tried all of the above from the python code and after connecting to a host from crowdstrike host dashboard. It never works when the directory is not empty.

What would be the recommended way to delete an entire directory?

Btw. the rmdir command is not listed in your falconpy documentation, but it is on the list of available commands in the crowdstrike host connection window. (Falcon Real Time Response)

[jkozlowicz]

rm seems not to work on Windows when a directory is not empty. To workaround this, I went for "runscript -Raw=```rm -rf {directory}```".

[jshcodes]

Swapping to using a raw script payload appears to be the only way to force this, as the -rm and -force parameters won't be respected using the regular command (it will only accept the directory path as an input parameter).

Thank you for identifying the documentation gap. We will get this updated!