Fingerprinting antivirus software
Antivirus fingerprinting is a process of searching and identifying antivirus software in a target endpoint based on identifiable constants, such as the following:
- Service names
- Process names
- Domain names
- Registry keys
- Filesystem artifacts
The following table will help you perform fingerprinting of antivirus software on the endpoint by the service and process names of the antivirus software:
Table 7.1 – Antivirus processes and services
Note
You do not have to rely only on process and service names—you can also rely on registry names, and more. We recommend that you visit the Antivirus-Artifacts project at https://github.com/D3VI5H4/Antivirus-Artifacts to find out more about this.
We can perform fingerprinting on a simple Python script, for instance, which will monitor all processes running on the operating system and compare predetermined strings.
For example, let&apos...
