CmdProcessor.exe is one of the processes spawned by the Trend Micro Control Manager.  It's responsible for sending XML instructions, formed by other processes, to managed products and processing product registration.  It also sends alerts, performs scheduled tasks, and applies Outbreak Prevention Policies. 

By sending a request to CmdProcessor.exe, which is listening on the default port 20101, the process can be detected.

The lockdown service, part of Apple iOS, was detected on the remote host.  This service is used to communicate with iOS devices for several tasks (e.g., Wi-Fi sync). 

Note that this plugin will only work against devices that have ever had Wi-Fi sync enabled (iOS versions 5 and later).

VMware vSphere, an enterprise server virtualization platform, is running on the remote host.

An OpenVAS Scanner daemon is listening on the remote port.  This is the component of OpenVAS that performs security scans and / or audits.

An OpenVAS Manager or OpenVAS Administrator daemon is listening on the remote port.  These are the components of OpenVAS that control the scanner and schedule tasks.

The remote host is running a Nexpose server, which is used for performing security scans.

The remote host is running a Greenbone Security Assistant server, which provides a web-based front-end to OpenVAS and related vulnerability scanning tools.

The remote host is running a SAP DIAG server, which is used to communicate with SAP GUI clients.

Microsoft Host Integration Server (HIS) is hosted on the remote host. HIS provides connectivity between Windows networks and IBM mainframe and mid-range computers.

The remote service is Symantec Veritas Enterprise Administrator, an application that provides features for administering disks, volumes, and file systems on local or remote machines.

The remote service is a Bitcoin node.  Bitcoin is an open source, peer-to-peer digital currency, and a Bitcoin node is used by a client to communicate with other peers.

Solstice Enterprise Agent (SNMP), an agent-management utility from Oracle, was detected on the remote host.

The remote host is running an OpenVPN server. Based on its responses, the remote host appears to be in TLS or preshared key mode.

The remote host is running a Citrix EdgeSight Load Tester (ESLT) server. Citrix ESLT is software used for load testing applications.

The remote service is HP iNode Management Center, a component in HP Intelligent Management Center User Access Manager (UAM) and HP Intelligent Management Center Endpoint Admission Defense (EAD).  Its main functions include unified authentication and Internet access control.

H3C / HP Intelligent Management Center (iMC), a server management application, is running on the remote host. This is a collection point for any H3C / HP Intelligent Management Center clients on the network.

Note that Intelligent Management Center (iMC) is an HPE product;
however, it is branded as H3C.

The remote service is a WINS (Windows Internet Name Service) server, which holds information about any NetBIOS-enabled hosts on the network. 

Note that the service may allow an arbitrary user to download the list, although some versions (eg, in Windows 2008) require an IP address to be specifically trusted to download the list by default.

The remote service is a Sybase M-Business Anywhere (formerly AvantGo) Sync Server, which handles synchronization requests from a mobile device and determines whether to obtain requested pages from the source web server or from a shared cache on the Sync Server itself.

The remote service is a Sybase M-Business Anywhere (formerly AvantGo) SOAP Server, which provides a web-based programming interface to server administration tasks in M-Business, such as configuration, group, user, and web channel management.

The remote device answered to a Link-local Multicast Name Resolution (LLMNR) request.  This protocol provides a name lookup service similar to NetBIOS or DNS.  It is enabled by default on modern Windows versions.

ActiveFax Server is running on this host.

The remote host is running an Eric cooperation server.  Eric is a Python IDE.

The remote host is running an HP StorageWorks File Migration Agent, which migrates rarely used files to external hosts, recalling them as needed.

Trend Micro Message Routing Framework (MRF) is running on the remote host. MRF is a component of the Trend Micro Infrastructure (TMI), which itself is a component of the Trend Micro Control Manager Architecture.

MRF interacts with Control Manager 2.x agents to communicate with managed products.

It is possible to detect Trend Micro products, like Control Manager and ServerProtect, by sending a 'heartbeat' packet to MRF.

The remote host is running a client relay service for Electronic Arts Need For Speed Underground or a clone of that game.

This is a kind of port mapper in that the service provides dynamic port numbers to client software.

The remote host is running an 'Aeonian Dreams' game server.

Microsoft Office Document Conversions Launcher is running on this port.  This service is installed by Microsoft SharePoint Server and allows for Office Documents to be converted into web documents for use in SharePoint server.

Microsoft Office Document Conversions Load Balancer is running on this port.  This service aides in the discovery of the Microsoft Office Document Conversions Launcher service and controls how jobs are routed to Conversions Launcher services.

The remote server is a UniRPC server.  Rocket Software services such as UniData and UniVerse use this RPC service.

The remote service supports the iSCSI (Internet Small Computer Systems Interface) protocol, which encapsulates the SCSI protocol over TCP/IP and allows sharing remote devices, known as 'targets', over a local- or wide-area network.

The remote host is running a DiskPulse Server, a tool that monitors changes to the filesystem and reports them to all authenticated clients.

The remote host is running an instance of Vuze Media Server.  This server is in the form of a plugin for Vuze, a BitTorrent client.

Based on its response to a TLS request with a specially crafted server name extension, it seems that the remote service is using the OpenSSL library to encrypt traffic.

Note that this plugin can only detect OpenSSL implementations that have enabled support for TLS extensions (RFC 4366).

The remote service is a Sybase PowerDesigner Repository Proxy, which allows users to issue SQL statements via an ODBC connection to be executed on the database server.

The remote host is a Novatel MiFi device, a portable access point using 3G/EVDO to connect to the Internet. 

The remote device is using the default password ('admin') for administrative access.  This may allow anyone on this network to log into the device and force it to connect/disconnect from the network.

The remote host is a Novatel MiFi device, a portable access point using 3G/EVDO to connect to the Internet.

The remote service is the Apple Remote Events Service, a remote events service that allows your computer to respond to events sent from other computers and interact with them on a network.

The remote service is a netsaint-statd daemon, a system monitoring tool designed to be integrated with Netsaint, although it can also be used without that. 

Netsaint is not maintained any more, the project evolved to Nagios.

An RSP agent is running on this port.  RSP is an agent-based system management and monitoring tool from Draconis Software.

A QNX qconn service is running on this host. 

QNX plans to add some authentication to qconn.  Meanwhile, qconn should be used only in development phase. 

Through this service, it is possible to upload and execute arbitrary code on the host.  An attacker can use this service to take complete control of the affected device.

The QNX pdebug remote debugging service is running on this host. pdebug should only be used only in development phase.

Through this service, it is possible to upload and execute arbitrary code on the host, read or modify memory, stop running processes, etc. 

An attacker can use this service to take complete control of the affected device.

The remote service is the D-link Click 'n Connect Daemon (DCCD), a remote networking service provided on some D-link networking devices that allows a remote client to view and configure the D-link device.

eyeMax DVR Server is running on this port.  This service controls network cameras, typically for a CCTV network.

Beanstalkd, a messaging server, is running on the remote host.

The remote host is a Lexmark printer.

By querying the device information page, this plugin attempts to identify the model, and various other key software versions such as kernel, engine, base installed on the remote Lexmark device.

A Tenable PVS Proxy service was detected on the remote host.

The remote host is running a Windows Media Service server, a media streaming server.

The remote service supports version 2 of the Internet Cache Protocol (ICP), used for communicating between web caches.

The remote service supports the Hyper Text Caching Protocol (HTCP), used for discovering HTTP caches and cached data, managing sets of HTTP caches, and monitoring cache activity.

ID	Name	Severity
57764	Trend Micro Control Manager CmdProcessor.exe Detection	info
57461	Apple iOS Lockdown Detection	info
57396	VMware vSphere Detect	info
56823	OpenVAS Scanner Detection	info
56822	OpenVAS Manager / Administrator Detection	info
56821	Nexpose HTTP Server Detection	info
56819	Greenbone Security Assistant detection	info
56981	SAP Dynamic Information and Action Gateway Detection	info
56632	Microsoft Host Integration Server Detection	info
56238	Symantec Veritas Enterprise Administrator Service (vxsvc) Detection	info
56195	Bitcoin Detection	info
56009	Solstice Enterprise Agent SNMP (snmpdx) Detection	info
56022	OpenVPN Server Detection	info
55926	Citrix EdgeSight Load Tester (ESLT) version detection	info
55906	HP iNode Management Center Detection	info
54998	H3C / HP Intelligent Management Center Detection	info
54629	WINS Server Detection	info
54617	Sybase M-Business Anywhere (AvantGo) Sync Server Detection	info
54616	Sybase M-Business Anywhere (AvantGo) SOAP Server Detection	info
53513	Link-Local Multicast Name Resolution (LLMNR) Detection	info
53322	ActiveFax Server Detection	info
52974	Eric Cooperation Server Detection	info
52654	HP StorageWorks File Migration Agent Detection	info
52653	Trend Micro Message Routing Framework Detection	info
52482	EA Need For Speed Underground Detection	info
52481	Aeonian Dreams Detection	info
51835	Microsoft Office Document Conversions Launcher Detection	info
51834	Microsoft Office Document Conversions Load Balancer Detection	info
51574	Rocket Software UniRPC Version Detection	info
29700	iSCSI Target Detection	info
51093	DiskPulse Server Detection	info
51060	Vuze Media Server Detection	info
50845	OpenSSL Detection	info
50704	Sybase PowerDesigner Repository Proxy Detection	info
50577	Ricoh Printer Detection	info
50514	Novatel MiFi Default Credentials	critical
50513	Novatel MiFi Detection	info
49793	Apple Remote Events Service Detection	info
49779	netsaint-statd Daemon Detection	info
49689	RSP Detection	info
48354	Unprotected QNX qconn Service	critical
48353	QNX pdebug Service Detection	critical
47605	D-link Click 'n Connect Daemon Detection	info
47135	eyeMax DVR Server Detection	info
46883	Beanstalkd Detection	info
46311	Lexmark Printer Detection	info
46212	Tenable PVS Proxy Detection	info
46016	Windows Media Service Server Detection	info
45609	Internet Cache Protocol (ICP) Version 2 Detection	info
45608	Hyper Text Caching Protocol (HTCP) Detection	info

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

info

info

critical

critical

info

info

info

info

info

info

info

info