performing-agentless-vulnerability-scanning

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: performing-agentless-vulnerability-scanning
description: Configure and execute agentless vulnerability scanning using network
  protocols, cloud snapshot analysis, and API-based discovery to assess systems without
  installing endpoint agents.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- agentless-scanning
- vulnerability-assessment
- cloud-security
- ssh
- wmi
- snapshot-analysis
- vuls
- tenable
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- GOVERN-1.1
- MEASURE-2.7
- MANAGE-3.1
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
- T1078.004
- T1530
---
# Performing Agentless Vulnerability Scanning

## Overview
Agentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux/FreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.


## When to Use

- When conducting security assessments that involve performing agentless vulnerability scanning
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites
- SSH key-based authentication configured on Linux/Unix targets
- WMI/WinRM access on Windows targets with appropriate credentials
- Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)
- Network access from scanner to target systems on required ports
- Service account with read-only access to target system configurations
- Python 3.8+ for custom scanning automation

## Core Concepts

### Agentless vs Agent-Based Scanning

| Aspect | Agentless | Agent-Based |
|--------|-----------|-------------|
| Deployment | No software installation needed | Agent install on every endpoint |
| Network dependency | Requires network connectivity | Works offline with cloud sync |
| Performance impact | Minimal on target systems | Light continuous overhead |
| Coverage depth | Depends on protocol/credentials | Deep local access |
| Cloud snapshot analysis | Native capability | Not applicable |
| Ideal for | Cloud VMs, IoT, legacy systems, OT | Managed endpoints, laptops |

### Agentless Scanning Methods

| Method | Protocol | Target OS | Port | Use Case |
|--------|----------|-----------|------|----------|
| SSH Remote Commands | SSH | Linux/Unix | 22 | Package enumeration, config audit |
| WMI Remote Query | WMI/DCOM | Windows | 135, 445 | Hotfix enumeration, registry checks |
| WinRM PowerShell | WS-Man | Windows | 5985/5986 | Remote command execution |
| SNMP Community | SNMP v2c/v3 | Network devices | 161 | Device fingerprinting, firmware check |
| Cloud Snapshot | Provider API | Cloud VMs | N/A | Disk image analysis |
| Container Registry | HTTPS | Container images | 443 | Image vulnerability scanning |
| API-Based | REST/HTTPS | SaaS/Cloud | 443 | Configuration assessment |

### Cloud Snapshot Analysis Flow
```
1. Scanner requests disk snapshot via cloud API
2. Cloud provider creates snapshot of VM root + data disks
3. Scanner mounts snapshot in isolated analysis environment
4. Scanner examines OS packages, configurations, file system
5. Snapshot is deleted after analysis (no persistent copies)
6. Results sent to central management console
```

## Workflow

### Step 1: SSH-Based Agentless Scanning (Linux)

```bash
# Create dedicated scan SSH key pair
ssh-keygen -t ed25519 -f /opt/scanner/.ssh/scan_key -N "" \
  -C "