Rumble 2.5: Identify endpoint protection agents, detect wireless & mobile Internet, and scan all your EC2 accounts

August 3, 2021, by

Thao Doan

What’s new with Rumble 2.5?

  • Identify endpoint protection agents via integrations and unauthenticated scans
  • Fingerprint wireless and mobile Internet on Windows without authentication
  • Better fingerprinting for Windows 10 and 11, desktop/server, secondary IPs
  • Discover AWS EC2 assets across all accounts
  • Report unmapped MACs

Keep reading to learn more about some of the new 2.5 capabilities.

Identify endpoint protection agents via integrations and unauthenticated scans

Rumble now includes CrowdStrike, McAfee, Avast, AVG, Checkpoint and Kaspersky endpoint protection solutions in its inventory. Depending on the vendor, we do this through unauthenticated network scans or pull in the information through integrations.

Integrate Rumble with CrowdStrike Falcon

You can now integrate CrowdStrike Falcon with Rumble through an authenticated API connection with the CrowdStrike backend. Quickly identify the assets that are missing an EDR agent with the new CrowdStrike Falcon connector. This capability helps determine off-site assets that are not being seen by your Rumble scans.

CrowdStrike EDR

For example, to find all Windows devices that do not have CrowdStrike installed, use this query:

os:windows and not source:crowdstrike

Rumble uses device attributes returned by the CrowdStrike connector for fingerprinting and asset enrichment. The CrowdStrike attributes are also searchable and supported by the Rumble asset attribute reports.

CrowdStrike attributes

Fingerprint Windows endpoint protection over the network, without credentials

Based on fun new research that we’ll reveal next week, Rumble can now fingerprint several endpoint protection agents running on Windows devices, remotely and without credentials. This currently includes support for some versions of McAfee, Avast, AVG, Checkpoint, and Kaspersky, with many more in our research queue. The EDR reporting is consistent with the new CrowdStrike Falcon connector (see below), which allows asset queries for has:edr.name to work regardless of how the EDR was detected.

EDR detected

We plan to share more about the techniques behind this work in an upcoming blog post next week. Subscribe to @rumblediscovery on Twitter to ensure you don’t miss this research report!

Fingerprint wireless and mobile Internet on Windows without authentication

Rumble now also flags assets that have active wireless and mobile Internet connections, remotely and without authentication.

WAN detected

Hint: This is based on the same research as our unauthenticated endpoint protection fingerprinting. More next week!

Better fingerprinting for Windows 10 and 11, desktop/server, and secondary IPs

The Rumble scan engine is now better than ever at fingerprinting assets running the Windows operating system. This release adds coverage for current builds of Windows 11 and Windows 10 21H2, as well as better discernment between workstation and server versions of the same build.

Windows systems

Lastly, Rumble now includes additional methods for reporting secondary IPv6 addresses as well as IPv4 addresses on Windows devices.

Secondary IPs

Discover AWS EC2 assets across all accounts

The AWS EC2 connector now supports multi-account instance discovery through STS “AssumeRole” capabilities. This connector can automatically create a new site for each VPC and reduce the work involved when multiple AWS accounts are used across the enterprise.

AWS EC2 instances

Improved Reports page

Easily find the report you need with the redesigned Reports page. Use the new top-level search bar to find the report you’re looking for. Please note that the Query tab has been moved and is now a top-level navigation item.

Reports page

Investigate your unknowns with the Unmapped MACs report

The Unmapped MACs Report provides context on what devices are missing from your scan scope. This report flags every asset that was found connected to a managed switch, but not correlated with a scan result, organization by switch port, and with the MAC, vendor and estimated device age on hand to support your investigation.

Unmapped MACs

Export network graphs to PNG

You can now export the Switch Topology and Network Bridges graphs as PNG files to embed into reports or presentations. Rumble will save the file based on your browser’s scale and resolution, so you can adjust your view as needed.

View site-specific dashboards

The new site switcher lets you filter your dashboard data by site. Switching the site will automatically update the dashboard with the relevant asset data–such as asset types, OSes, and hardware–and services data–such as TCP ports, UDP parts, and protocols. To share a site-specific dashboard, you can copy the URL and send it out to your team.

Site switcher

Release notes

This release includes a rollup of all the 2.4.x updates. Read the changelog to see all the improvements and updates in this release.

Try Rumble

Don’t have access to Rumble yet? Sign up for a free trial to try out these capabilities for 21 days.

Similar Content

September 8, 2021

Rumble 2.6: Integrate with Microsoft Azure Cloud, identify EOL assets, self-host in offline mode, and detect more protocols

What’s new with Rumble 2.6? Synchronize your Azure VM inventory with Rumble Identify assets running end-of-life OS versions Support for NFS, PPTP, and “r” services Updates to the CrowdStrike integration Install and update self-hosted Rumble in offline mode See new …

Read More

August 19, 2021

BlackHat gems: HP iLO 5 vulnerabilities

Each year, August arrives with promises of hot weather and cool security research talks. The DEF CON, Black Hat, and BSidesLV security conferences bring people in from all over the world to share knowledge through conversations, villages, training, and talks. There are …

Read More

August 11, 2021

Fingerprinting Windows versions, AV, wireless cards over the network—all without authentication

Correctly identifying and categorizing network-connected systems without credentials is a tricky challenge and one of the fun parts of working at Rumble. This process of “fingerprinting” uses thousands of rules, pattern matches, and internal databases to take observed …

Read More