Systems and methods include a host system that is configured to execute a security agent that is configured to allow and block flows in a network, on the network interface, receive a script from a command & control server, and execute the script via an interpreter associated with the security agent, wherein the script is configured to any of disable behavior and modify behavior of the security agent at one or more hook points in the security agent.