Skip to content

Instantly share code, notes, and snippets.

@Ambroos
Last active September 29, 2025 10:19
Show Gist options
  • Save Ambroos/f6f37398e3aecd7da467cbcf85d5299b to your computer and use it in GitHub Desktop.
Save Ambroos/f6f37398e3aecd7da467cbcf85d5299b to your computer and use it in GitHub Desktop.

Revisions

  1. Ambroos revised this gist Sep 18, 2020. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions WARNING.md
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    # USE AT OWN RISK
    This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.
    This was only tested on a 'partial' SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension. (Some things failed while I was messing around with OS betas.)

    This is **OLD**, I'm not exactly maintaining this because I now have a more sensible employer.
    # This script is most likely outdated.
    A lot happens in 2+ years, at this point there's a good chance this script will do more harm than good. Read the comments before using!
  2. Ambroos revised this gist Jul 23, 2020. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion WARNING.md
    Original file line number Diff line number Diff line change
    @@ -1,2 +1,4 @@
    # USE AT OWN RISK
    This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.
    This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.

    This is **OLD**, I'm not exactly maintaining this because I now have a more sensible employer.
  3. Ambroos revised this gist May 25, 2018. No changes.
  4. Ambroos revised this gist Sep 1, 2017. 2 changed files with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions WARNING.md
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,2 @@
    # USE AT OWN RISK
    This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.
    File renamed without changes.
  5. Ambroos revised this gist Sep 1, 2017. No changes.
  6. Ambroos created this gist Sep 1, 2017.
    104 changes: 104 additions & 0 deletions removekebab.sh
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,104 @@
    launchctl remove com.sentinelone.sentineld-helper
    launchctl remove com.sentinelone.sentineld-updater
    launchctl remove com.sentinelone.sentineld
    launchctl remove com.sentinelone.sentineld-guard

    killall SentinelAgent

    rm -rf /Library/Extensions/Sentinel.kext
    rm -rf /Library/Extensions/Sentinel.kext/Contents
    rm -rf /Library/Extensions/Sentinel.kext/Contents/Info.plist
    rm -rf /Library/Extensions/Sentinel.kext/Contents/MacOS
    rm -rf /Library/Extensions/Sentinel.kext/Contents/MacOS/Sentinel
    rm -rf /Library/Extensions/Sentinel.kext/Contents/Resources
    rm -rf /Library/Extensions/Sentinel.kext/Contents/Resources/en.lproj
    rm -rf /Library/Extensions/Sentinel.kext/Contents/Resources/en.lproj/InfoPlist.strings
    rm -rf /Library/Extensions/Sentinel.kext/Contents/_CodeSignature
    rm -rf /Library/Extensions/Sentinel.kext/Contents/_CodeSignature/CodeResources
    rm -rf /Library/LaunchAgents/com.sentinelone.agent.plist
    rm -rf /Library/LaunchDaemons/com.sentinelone.sentineld-guard.plist
    rm -rf /Library/LaunchDaemons/com.sentinelone.sentineld-helper.plist
    rm -rf /Library/LaunchDaemons/com.sentinelone.sentineld-updater.plist
    rm -rf /Library/LaunchDaemons/com.sentinelone.sentineld.plist
    rm -rf /Library/Preferences/Logging/Subsystems/com.sentinelone.sentinelctl.plist
    rm -rf /Library/Preferences/Logging/Subsystems/com.sentinelone.sentineld-guard.plist
    rm -rf /Library/Preferences/Logging/Subsystems/com.sentinelone.sentineld-helper.plist
    rm -rf /Library/Preferences/Logging/Subsystems/com.sentinelone.sentineld-updater.plist
    rm -rf /Library/Preferences/Logging/Subsystems/com.sentinelone.sentineld.plist
    rm -rf /Library/Sentinel
    rm -rf /Library/Sentinel/sentinel-agent.bundle
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Resources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Sentinel
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A/Resources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A/Resources/Info.plist
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A/Sentinel
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A/_CodeSignature
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/A/_CodeSignature/CodeResources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/Sentinel.framework/Versions/Current
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Frameworks/sentinel.dylib
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Info.plist
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Info.plist
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/MacOS
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/MacOS/SentinelAgent
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/AppIcon.icns
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/Assets.car
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/Base.lproj
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/Base.lproj/MainMenu.nib
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/CellView.nib
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/DebugMenu.nib
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/MenuPopupView.nib
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/divider.tiff
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/en.lproj
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/en.lproj/InfoPlist.strings
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/en.lproj/Localizable.strings
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/greenBadge.tiff
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/logo.tiff
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/Resources/redBadge.tiff
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/_CodeSignature
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app/Contents/_CodeSignature/CodeResources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sdiagnose
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentinelctl
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_guard
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_updater
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/COPYRIGHT
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/arbiter.db
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/arbiter.db.sig
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/signatures.db
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/signatures.db.sig
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/whitelist-ext.db
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/assets/whitelist-ext.db.sig
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/common.sb
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/en.lproj
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/en.lproj/InfoPlist.strings
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/guard.sb
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/helper.sb
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/sentinel-labs.cer
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/sentineld.sb
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/sentinelone.cer
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/uninstall.sh
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/Resources/whitelist-ext.json
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature/CodeDirectory
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature/CodeRequirements
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature/CodeRequirements-1
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature/CodeResources
    rm -rf /Library/Sentinel/sentinel-agent.bundle/Contents/_CodeSignature/CodeSignature
    rm -rf /private/etc/asl/com.sentinelone.sentinel
    rm -rf /usr/local/share/man/man1/sentinelctl.1

    killall SentinelAgent

    pkgutil --forget com.sentinelone.pkg.sentinel-agent