Does anyone know of a method to fingerprint machines in the LAN and find out what kind of AV software is installed?

  • 3
    I'm sure something could be gleaned from the signature update transactions, if you're willing to wait for them. – Iszi Feb 24 '12 at 20:54
  • True! Thats a very good idea. – Erik Feb 24 '12 at 21:00

There are two ways to detect this, Passive or Active.


This is what Iszi was referring to. If you can get yourself in the data stream you can glean lots of information. Using flow analysis you can watch for machines making connections to known update servers. So look around at some AV products, get a list of IP addresses from which they serve their updates, and then filter on some of the common data transfer ports. For AV this tends to be either HTTP, both 80 or 443 or FTP.

If you have access to the data stream directly, whether through a tap or span port, you can do some deeper analysis. Here, you can actually troll through the communications channel to look for signature bundle downloads. Depending on the vendor you may even be able to get exact product and/or version numbers from the UserAgent or filename of the signature bundles.

Additionally, if you have an IDS/IDP in place, you could likely construct your own signatures to look for this kind of behavior. Or, better yet, your vendor may even provide some. For example, Sourcefire ships a very large contingent of "Policy" signatures that allow you to look for corporate policy violations such as browsing job search websites, performing Google Images searches with SafeSearch disabled, or using Skype. You may be able to find application signatures for AV in a package like this.


This is what you really want, to log into the systems themselves and check the software inventory. Being able to do this is highly dependent on your organization and how how much control you have over the client machines. If you have administrative access to the systems, you can remotely log in and pull whatever information you want. Nessus, for example, given Administrator privileges will perform a full software inventory. Or, the same information can be gathered through SCCM. You can always resort to writing a WMI a script to remotely poll, but there are so many better tools out there now, that you shouldn't have to.

If you're lucky enough to have a NAC system in place, you could also perform this polling as part of your pre-authentication posture assessment. Of course, if you're lucky enough to have a fully functional NAC in place, then you're probably lucky enough to have some of the other methods available as well.


Do you have access to these machines from an admin standpoint, it might be difficult to tell AV software based only on a vulnerability scan.

If you have admin access on these machines, you might be able to pull WMI or some other service. Using something like a credentialed scan with Nessus will often tell you what AV is installed or can be used to get a list of all programs installed and running services.

Without access from just the network level, you would need to passively capture traffic looking for signatures back to a local update server or to IP addresses of known remote AV server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.