Not only can you write such a program, you probably already have one. If you run the standard Bitcoin Core client, you will see that
debug.log logs the IP addresses of every network node it communicates with. (It's irrelevant whether you use the client for mining or not - even non-mining nodes need to connect to peers, and could keep track of which peers they have found.)
On the one hand, an attacker could consider these targets more tempting, on the grounds that there might be bitcoins stored on those machines. On the other hand, since at present Bitcoin users tend to be more technically skilled than the general public, these machines might be better secured than the average computer on the Internet, making them harder targets.
Ordinary clients and solo miners are both likely to run regular Bitcoin clients. I don't know of any reliable way for an attacker to tell whether a node is mining or not. The best approach might be for the attacker to have a large number of nodes, each connected to a large number of peers, and watch for the first appearance of a new block. The first node to have sent out that block is somewhat more likely to be the miner that found it - but the attacker can't rule out the possibility that that node was simply relaying a block sent to it by someone else.
Anyway, it's not clear that a solo miner would be a more profitable target than anyone else on the network - miners don't necessarily store their earned coins on the mining machine. The attacker could take control of a solo miner and make it mine for her instead, but odds are that she would be discovered long before the miner finds a block. (She would certainly be discovered as soon as it did find one, when the miner notices that the block reward didn't go to the right place.)
Pool miners don't need to participate in the peer-to-peer Bitcoin network, so they could not be discovered in this way. The pool operator can run a regular Bitcoin node that looks no different from any other node.