StandAlone Scan

[#1]

Article Number

000033081

Applies To

RSA Product Set: ECAT
RSA Version/Condition: 4.1.x and higher versions
Platform: Windows
Product Name: RSA
Product Description: ECAT Agents

Issue

Purpose of the Standalone Agent Scan.
How to configure and what are ramifications (if any) when running on a compromised or infected system. 

Task

Directions from the 4.1 ECAT User Guide (page 122)

Perform a Scan in Standalone Mode

If the client machine is not connected to a network and cannot communicate with ConsoleServer, a scan in stand-alone.

The mode can be performed.

This type of scan is performed manually on the client machine.

Use ECAT UI to generate a scan configuration file.

To generate the scan configuration file:

1. Click Tools > Standalone Scan > Export Scan Configuration.
2. (Optional) Select desired parameters.
3. You have two options for scanning:

   ◦ Click Quick Scan or Full Scan under the Default tab of the Request Scan dialog box.

   ◦ If you wish to customize the categories or parameters for your scan, access the Advanced tab, select the desired options, and click Proceed.

4. Enter a password to protect the scan configuration file and click OK.

   Note: The password must be between 8 and 32 characters. It should be recorded for reference because it will be used later in the process.

5. Navigate to the location where you want to save the file.
6. Enter a filename and click Save.
7. Transfer the scan configuration file to the client machine. This can be performed with a USB key or any other kind of media.
8. Install the agent using the same package that would have been used for a normal agent installation.

   Note: If the agent is already deployed, it does not need to be reinstalled. Any agent installation will work.

Once the agent is installed, start the stand-alone scan.

To start a stand-alone scan:

1. Open a command prompt on the client machine.
2. Locate the client .exe file in the folder C:\windows\system32.

   The filename is the one provided in the “ECAT Service Name” field in the ECAT Packager.

3. Run the .exe file in the command prompt using the following syntax:

   ECAT /password <password> /scanfile <scan config file>

   Where:

   <password> is the password provided to ECAT UI when generating the scan configuration file.

   <scan config file> is the path to the scan configuration file.

   Wait until the “Scan completed” message is displayed.

4. Transfer the result file back to the machine hosting ECAT UI for the import after the scan is completed.

   Note: The file location is displayed in the command prompt.

To import stand-alone scan data:

1. Click Tools > Standalone Scan > Import Scan Data.
2. Navigate to the location of the scan data file and click Open.
3. Enter the same password that was provided earlier in the process.
4. The scan has now been queued and will be processed by ConsoleServer

Resolution

The reason for a stand-alone feature would make it possible to collect data from air-gapped machines and those that are disconnected from the network due to being infected with a virus or malware.

The scan is composed of two files.
The requested file is the configuration information needed to run the scan and the received file contains the results of the scan.
Both files are encrypted.
Contents of the results file are not executable, so they can be imported and processed by ECAT.