VIPERSCAN
Operator-Driven Remote Endpoint AV Scanner
• Active1. Snapshot
ViperScan triggers silent on-demand antivirus scans on Windows endpoints through your RMM, parses the results centrally, and lets a human operator manually quarantine, dismiss, or escalate each finding from a web dashboard. It is not an EDR. It does not provide real-time protection. It does not act on its own — it is a thin, transparent, pluggable layer that lets you push a "scan now" button across a fleet and triage what comes back.
2. Why ViperScan
You probably already have most of a security posture:
- A detection stack (Wazuh, Security Onion, an SIEM) that fires alerts but doesn't action them.
- A lightweight AV on each endpoint (Defender, ESET, Malwarebytes) that protects the box but offers no centralized way to trigger and review scans across the fleet.
- An RMM (MeshCentral, Tactical RMM, NinjaOne, Atera, ConnectWise, Datto, Kaseya) that can run scripted scans — but typically in an active, user-visible session. Fine for a workstation at lunch; very much not fine for a gaming PC mid-match or a studio workstation mid-render.
- What you didn't deploy: heavy EDR (CrowdStrike, SentinelOne, Defender for Endpoint), because those kernel-level agents are unwelcome on gaming rigs, DAWs, CAD machines, and any workload that breaks when something shims the kernel.
What's missing is the silent on-demand scan + triage layer. An alert fires (or you just want a Tuesday-morning sweep); you push "scan now" at one endpoint or a hundred; the scan runs invisibly in the background as SYSTEM; results land in one dashboard where a human decides whether to quarantine, dismiss, or escalate. ViperScan is that missing piece — it complements your detection stack and your RMM, it does not replace either.
3. Pluggable Architecture
Scanners Are Pluggable
Every AV vendor is described by a YAML file in scanners/. The backend loads those at startup and builds in-memory Scanner objects. No AV vendor name appears in Python — scan commands, log paths, parser patterns, and quarantine commands all live in YAML. Adding a scanner means dropping a new .yaml file and restarting the container: no code changes, no rebuild.
RMMs Are Pluggable
ViperScan ships no agent of its own. It executes through whatever RMM you already run, via a pluggable adapter layer that mirrors the scanner layer. The backend talks to a small RMMAdapter interface (push-file, run-script, read-file, list-endpoints); concrete adapters translate those into one RMM platform's REST/RPC surface. No RMM vendor name appears in the backend's domain code — the MeshCentral specifics live entirely inside the MeshCentral adapter (shipping in v1).
Silent Execution
Every command is wrapped in powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden, and child processes use Start-Process -WindowStyle Hidden. No console windows, no UAC prompts, no user-visible artifacts. The RMM agent runs as SYSTEM, so elevated commands execute without prompting the logged-in user.
Three scanner types are supported: built-in (already present on the OS, e.g. Defender),
standalone (a single binary auto-downloaded from the vendor's CDN), and
detect_local (requires the product installed by the operator; ViperScan probes
binary.detect_paths and fails fast with the YAML's install_hint if nothing matches).
4. Scanner Verification Scorecard
An honest scorecard from the live-test session against a real Windows endpoint. "Verified" means exercised end-to-end on a real endpoint, not "the patterns look right." Grouped most-trustworthy first.
| ID | Display name | Type | Verification | Notes |
|---|---|---|---|---|
defender |
Microsoft Defender Antivirus | built-in | ✅ fully verified | Clean + EICAR + quarantine cycle, live. (A pre-Phase 11.x silent quarantine bug is fixed.) |
emsisoft |
Emsisoft Emergency Kit (a2cmd.exe) |
standalone | ✅ fully verified | Clean + EICAR via Target Scan (EICAR-Test-File). engine 2025.7.0.12683. |
clamav |
ClamAV (clamscan.exe) |
detect_local | ✅ fully verified | Clean + EICAR via Target Scan (Eicar-Signature). engine 1.4.1. Operator runs freshclam first. |
msert |
Microsoft Safety Scanner (MSERT) | standalone | 🟡 clean-only | Clean runs verified. No Target Scan in MSERT's CLI → EICAR detection unverified (shares Defender's engine, a strong indirect signal). |
kvrt |
Kaspersky Virus Removal Tool | standalone | 🔒 blocked (vendor) | Orchestration works; Kaspersky 403s the unattended download. Manual install: drop KVRT.exe and auto-detect finds it. |
drweb |
Dr.Web CureIt! | standalone | 🔒 blocked (vendor) | Orchestration works; download 404s / form-gated. Manual install: drop cureit.exe. |
malwarebytes |
Malwarebytes (consumer) | detect_local | 🧩 detect-only | Consumer mbam.exe has no scan CLI. Placeholder for fleet visibility only. |
bitdefender |
Bitdefender Endpoint | detect_local | 🛠 install-required | Licensed BEST. Detect probe verified; CLI flags from vendor docs, not live-run. |
eset |
ESET Endpoint (ecls.exe) |
detect_local | 🛠 install-required | Needs an ESET Endpoint trial. Detect probe verified; CLI flags from vendor docs. |
sophos |
Sophos Anti-Virus (sav32cli.exe) |
detect_local | 🛠 install-required | SAV32CLI is EOL (Jul 2023) — no obtainable build to test. Patterns from real savscan output. |
Verification levels:
- ✅ fully verified — clean scan and EICAR threat detection both confirmed end-to-end against a real endpoint.
- 🟡 clean-only — clean scan confirmed live; threat detection unverified due to a scanner CLI limitation.
- 🔒 blocked (vendor) — orchestration is correct, but the vendor won't serve the binary to an unattended download. Works once an operator stages the EXE manually.
- 🧩 detect-only — no operator-runnable scan CLI exists; the entry only reports whether the product is installed.
- 🛠 install-required — needs the operator to install a paid/trial/EOL product. The detect probe is verified; the scan CLI is from vendor docs and not live-run.
5. Screenshots
6. License
ViperScan is open source under the MIT license, part of the Viper Family ecosystem by VenomousViper Labs. The family shares a focus on transparent code and self-hosted deployment: a single Docker container, scanner YAMLs and the SQLite database bind-mounted so they can be edited and inspected from the host without rebuilding the image.