Update enum_av.py

Added a few more signatures for Trend Micro monitoring, one for Rapid7 Insight Agent, and some for Ivanti Security 

Signed-off-by: n00py <n00py@protonmail.com>

Author: n00py

nxc/modules/enum_av.py

@@ -289,6 +289,14 @@ def LsarLookupNames(self, dce, policyHandle, service):
                 {"name": "exploitProtectionIPC", "processes": ["AVKWCtlx64.exe"]}
             ]
         },
+        {
+        "name": "Ivanti Security",
+            "services": [
+                {"name": "STAgent$Shavlik Protect", "description": "Ivanti Security Controls Agent"},
+                {"name": "STDispatch$Shavlik Protect", "description": "Ivanti Security Controls Agent Dispatcher"}
+            ],
+            "pipes": []
+        },
         {
             "name": "Kaspersky Security for Windows Server",
             "services": [
@@ -335,6 +343,11 @@ def LsarLookupNames(self, dce, policyHandle, service):
             ],
             "pipes": []
         },
+        {
+            "name": "Rapid7",
+            "services": [{"name": "ir_agent", "description": "Rapid7 Insight Agent"}],
+            "pipes": []
+        },
         {
             "name": "Sophos Intercept X",
             "services": [
@@ -384,7 +397,10 @@ def LsarLookupNames(self, dce, policyHandle, service):
                 {"name": "Trend Micro Web Service Communicator", "description": "Trend Micro Web Service Communicator"},
                 {"name": "TMiACAgentSvc", "description": "Trend Micro Application Control Service (Agent)"},
                 {"name": "CETASvc", "description": "Trend Micro Cloud Endpoint Telemetry Service"},
-                {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"}
+                {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"},
+                {"name": "ds_agent", "description": "Trend Micro Deep Security Agent"},
+                {"name": "ds_monitor", "description": "Trend Micro Deep Security Monitor"},
+                {"name": "ds_notifier", "description": "Trend Micro Deep Security Notifier"}
             ],
             "pipes": [
                 {"name": "IPC_XBC_XBC_AGENT_PIPE_*", "processes": ["EndpointBasecamp.exe"]},