RemoteEDRDetector

Standalone Python tool for detecting AV/EDR solutions installed and running on remote Windows hosts, without requiring NetExec or any pentesting framework.

How it works

Detection is performed in two independent phases over a single shared SMB session:

Phase 1 LsarLookupNames (installed services)

Connects to the remote \PIPE\lsarpc named pipe and queries the LSA policy for each known AV/EDR NT service name using LsarLookupNames. If Windows can resolve NT Service\<name> to a SID, the service is registered on the system. This requires no administrative privileges.

Phase 2 IPC$ Named Pipe enumeration (running processes)

Lists all named pipes exposed under IPC$ and matches them against known patterns using glob matching. A matching pipe indicates the corresponding process is currently running, even if the service itself was not detected in Phase 1.

Both phases share the same SMB session, avoiding double authentication and the STATUS_LOGON_FAILURE issues that arise when two independent sessions are opened against hardened hosts.

Detected products

Product	Services	Pipes
Acronis Cyber Protect	✓
Avast / AVG	✓	✓
Bitdefender	✓	✓
Carbon Black App Control	✓
Check Point Endpoint Security	✓
Cortex XDR	✓
CrowdStrike Falcon	✓	✓
Cybereason	✓	✓
Cynet	✓
Elastic EDR	✓	✓
ESET	✓	✓
FortiClient	✓	✓
FortiEDR	✓
G DATA Security Client	✓	✓
HarfangLab EDR	✓	✓
Ivanti Security	✓
Kaspersky Security for Windows Server	✓	✓
Malwarebytes	✓	✓
Panda Adaptive Defense 360	✓	✓
Rapid7 Insight Agent	✓
SentinelOne	✓	✓
Sophos Intercept X	✓	✓
Symantec Endpoint Protection	✓
Trellix EDR	✓	✓
Trend Micro Endpoint Security	✓	✓
Wazuh	✓
Windows Defender	✓
WithSecure Elements	✓	✓

Requirements

Python 3.8+ and impacket:

pip install impacket

Usage

python av_detector.py [-h] (-t TARGET | -T TARGETS)
                      -u USERNAME [-d DOMAIN] [-p PASSWORD]
                      [--lmhash LMHASH] [--nthash NTHASH] [--aeskey AESKEY]
                      [--kerberos] [--kdchost KDCHOST] [--hostname HOSTNAME]
                      [-v]

Arguments

Argument	Description
-t TARGET	Single target IP or hostname
-T TARGETS	File with one target per line (lines starting with # are ignored)
-u USERNAME	Username
-d DOMAIN	Domain name (FQDN preferred, e.g. corp.local)
-p PASSWORD	Plaintext password
--lmhash	LM hash
--nthash	NT hash, or LM:NT combined string (pass-the-hash)
--aeskey	AES-128 or AES-256 key (Kerberos)
--kerberos	Use Kerberos authentication
--kdchost	KDC / Domain Controller IP (required for Kerberos)
--hostname	Target NetBIOS hostname (required for Kerberos FQDN resolution)
-v	Verbose — prints every service and pipe checked

OpSec considerations

This tool is designed to be low-noise, but no remote technique is invisible. Key points to be aware of:

What is quiet:

• LsarLookupNames is a standard Windows RPC call used constantly by legitimate tools. A single call generates no alert on its own.
• The SMB session reuse avoids the double-authentication anomaly that triggers alerts on hardened hosts.

What can be detected:

• ~150 consecutive LsarLookupNames calls in a few seconds is an anomalous pattern detectable by behavioral analytics (CrowdStrike, Defender for Identity, SentinelOne).
• Listing IPC$ with a wildcard is rarely done by legitimate software and may generate SMB audit events.
• The SMB logon itself (Event ID 4624) is always logged. A privileged account authenticating to many hosts in a short window will trigger UEBA alerts regardless of what happens after.

Credits

• Original NXC module: @mpgn_x64
• Service/pipe signatures: @an0n_r0
• Impacket: SecureAuthCorp/impacket

Disclaimer

This tool is intended for use in authorized penetration tests and red team engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal.