Accounts and sessions

Kind

State - something true when Signal read the host

Built-in rules reading it

3

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

account.rid

int

A local account's relative ID: 500 is the built-in Administrator and 501 the Guest account, whatever they were renamed to.
derived: the last part of the account's SID

account.enabled

bool

Whether a local account is enabled.

account.locked

bool

Whether a local account is locked out.

account.admin

bool

Whether a local account is a member of the local Administrators group, directly or through another group.

account.groups

string

The local groups a local account belongs to, comma-separated.

account.full_name

string

A local account's full name, as set on the account.

account.password_last_set

time

When a local account's password was last set.

account.password_never_expires

bool

Whether a local account's password is set never to expire.

account.last_logon

time

A local account's last logon, as this host's account database records it.

account.logon_count

int

How many times a local account has logged on, as this host's account database counts.

account.internet_identity

string

The Microsoft account (sign-in name) a local account is connected to.

Kind

State - something true when Signal read the host

Built-in rules reading it

1

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

account.sid_type

string

What a group member's SID is, as this host resolves it: user, group, well-known group, deleted account, or unknown (a domain SID, not looked up).

Kind

State - something true when Signal read the host

Its time is

profile created

Built-in rules reading it

0

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

profile.path

string

A user profile's folder.

profile.registered

bool

Whether the registry's profile list names the profile folder; false for a folder left behind by a deleted account, or copied in.
derived: compared by Signal: the profiles folder against the registry's profile list

profile.created

time

When the profile folder was created: the account's first interactive sign-in on the host.

profile.last_used

time

When the profile was last loaded - the account's last interactive sign-in (or its NTUSER.DAT's last write).

Kind

State - something true when Signal read the host

Its time is

signed in

Built-in rules reading it

0

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

session.id

int

An interactive session's number in Windows' session manager (1 is usually the console on a client).

session.state

string

A session's state now: active (in use), disconnected (signed in, but nobody connected to it), ...

session.client

string

The remote client's computer name, for a Remote Desktop session.

session.logon_time

time

When the session's account logged on.

session.how

string

How the session was signed in to: console (at the machine, or its virtual console) or remote desktop.
derived: decided by Signal from the session's window station (Console, or RDP-Tcp#n)

session.disconnected_since

time

When a disconnected session was left: its account is still signed in, but nobody has used it since.

session.own

bool

Whether this is the session Signal itself ran in - the analyst who collected the host, not a user of it.
derived: compared by Signal: the session against its own process's session