Remote access

Kind

State - something true when Signal read the host

Built-in rules reading it

14

remote.product

string

The remote access product, by Signal's catalog name (internal/remotetools) - the same name on every host.

remote.kind

string

What kind of product it is: remote control, remote support (a person invited to connect), or an RMM agent (an organisation's management console reaches the host through it).

remote.mode

string

How it is on the host: installed (an installation record, a service, its install folder), portable (it ran, or left its files, from outside any install location with no installation), installed and portable (both - a second copy beside the installed one), or traces only (its configuration or logs remain; no program and no installation was found).
derived: from remote.installed and remote.portable, by providers/remoteaccess

remote.installed

string

What records it as installed, each place named: an installed application (with its install date and for whom), a service (its program and start type), its install folder (with the folder's creation time); absent when nothing does.

remote.portable

string

Each copy that ran or left its files outside an install location: its path, the kind of folder (a user's Downloads, Desktop, temporary folder, a share ...), who ran it, how many runs and when, and whether the file is still there.

remote.programs

string

Every program file of the product found - installed or portable - separated by "; ".

remote.identified_by

string

How each part was recognised as the product: an installed application's name, a service's name, its version resource (what the program says it is, whatever its file is called), its file name only (a lead - the file could not be read or says nothing), its own folders.

remote.renamed

string

Copies whose version resource names the product while their file name is not one of the product's: the file was renamed after it was built - with the name its version resource gives.

remote.signer

string

The signature of each program file found, as Windows checks it: the signer, valid or not, or unsigned - and whether the signer is the product's vendor.

remote.run_as

string

The accounts it ran as, from each source that records one (a run's user, a running process's token, a service's account).

remote.service

string

Its services: name, program, start type, account, state.

remote.service_user_folder

string

A service of the product whose program is in a user's folder, a temporary folder or ProgramData's root - where no installer puts a service - with its path.

remote.running

string

Its processes running when Signal read the process table: program, PID, account, start time.

remote.first_seen

time

The earliest time any source records it: an install date, a folder's creation, a run, a log line. Earlier presence may have left no record.

remote.last_seen

time

The latest time any source records it in use: a run, a log line, a running process.

remote.in_period

bool

true when it was first seen inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the RemoteAccess module from remote.first_seen and the profile's window

remote.tool_id

string

The product's own ID for this host - what someone connecting to it enters - from its configuration, with the file or key it is in.

remote.alias

string

The name the product shows for this host, from its configuration.

remote.account

string

The account signed in to the product or that enrolled it (an e-mail address, a console account), from its configuration - who controls it from the vendor's side.

remote.tenant

string

The organisation, company or group the product is enrolled to, from its configuration.

remote.server

string

The server the product is configured to report to, from its configuration or its service's command line.

remote.custom_server

bool

true when remote.server is not one of the vendor's own servers - an organisation's own server, or someone's; absent when the product has no vendor servers to compare with, or no server is configured.
derived: from remote.server and the catalog's vendor servers, by providers/remoteaccess

remote.unattended

string

"set" when its configuration holds an unattended access password or key - someone can connect without a person at the host accepting - with the file or key and its last write; the value itself is never read into the output. Absent when none was found (or the product's configuration is not read).

remote.safe_mode

string

The registry key that makes one of its services start in Safe Mode with networking (SafeBoot\Network), with its last write - where most security software does not run.

remote.logs

string

Its own log files read, each with its size, what was read of it and the span of its lines; or that Signal does not read this product's logs yet.

remote.log_state

string

When its logs cannot tell the whole story: "no log found" though it ran or is installed, "log empty", or "log begins after its first run" (with both times) - a log removed or trimmed by whoever used it, or one the product never wrote; absent when its logs cover its known use, or Signal does not read this product's logs.
derived: from remote.logs and remote.first_seen, by providers/remoteaccess

remote.sessions

string

The sessions its logs record: how many incoming and outgoing, from how many peers, over what span.

remote.peers

string

The other sides its logs record, by the product's ID for them, with their names and session counts.

remote.started

string

Command shells and system tools the product's own processes started (a process's parent): each with its time, account and command line where recorded - what someone did through it.
derived: from process creations and the process table, by the RemoteAccess module and providers/remoteaccess

remote.downloaded

string

Downloads of its program the browsers recorded: from where, when, to which path.
derived: joined from the Browsers module's downloads by the RemoteAccess module

remote.persists

string

Auto-start entries and scheduled tasks that run its program.
derived: joined from the Persistence module's records by the RemoteAccess module

remote.removed

string

Evidence it was removed: Windows Installer's removal (with the account and time), or a program found by its runs that is no longer on disk.

remote.others

string

Every remote access product found on the host, this one included, separated by ", " - the same on each of them.
derived: by the RemoteAccess module

remote.allowed

string

Whether the analyst's approved list (the profile's modules.RemoteAccess.approved_tools) includes it: "yes - <entry>" or "no"; absent when no list was given (authorization unknown).
derived: by the RemoteAccess module from its allowed parameter

remote.contacts

string

Its address book as its configuration records it: the IDs the local user saved - peers the user, or whoever used the account, meant to reach again.

remote.listen

string

Where it listens for connections, from its configuration (a port).

remote.token

string

"set" when its configuration holds an account token it connects with (a tunnel's), with where - who it connects as at the vendor; the token itself is never read into the output.

remote.sources

string

Every place that records the product on this host, separated by "; ".

Kind

Event - something that happened at a time

Its time is

session started (the tool's log)

Built-in rules reading it

1

remote.product

string

The remote access product, by Signal's catalog name (internal/remotetools) - the same name on every host.

session.direction

string

incoming (someone connected to this host) or outgoing (this host connected to another), as the product's log records it.

session.start

time

When the session began, by the product's log - in UTC; a log written in the host's local time is converted with the host's current zone (a daylight saving change since may shift it by an hour).

session.end

time

When it ended: the product's own record of it, or the first session close its log records after the start (and before the next session); absent when none is recorded.

session.duration

string

How long it lasted (end - start); "end not recorded" without an end.
derived: from session.start and session.end

session.peer_id

string

The product's ID for the other side - the same whichever host it connects to, so the same ID on several hosts is one remote party.

session.peer_name

string

The name the other side gave itself, as the log records it - chosen by that side.

session.address

string

The address the product recorded for the connection, on the session's own line or within two minutes of its start - the other side's, or the vendor's relay it came through; session.address_scope says whether it is public.

session.address_scope

string

public, private, shared (carrier-grade NAT), loopback, link-local or multicast.
derived: from session.address

session.account

string

The Windows account of the session, as the log records it, else the profile the log is in.

session.auth

string

How the session was allowed, as the product records it, in words: accepted by the user at the screen, the unattended access password, a saved login token, rejected.

session.type

string

The kind of session, as the product records it (remote control, file transfer, VPN ...).

session.log

string

The log file (and its profile) the session was read from.

session.transfers

string

The file transfers the product's logs record during the session, by direction, with up to ten files.

session.in_period

bool

true when it began inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the RemoteAccess module

Kind

Event - something that happened at a time

Its time is

transfer logged (the tool's log)

Built-in rules reading it

2

remote.product

string

The remote access product, by Signal's catalog name (internal/remotetools) - the same name on every host.

transfer.action

string

What the log says was done with the file, in its words or what they mean ("sent from this host", "written to this host", "download", "upload") - a word such as download is the product's, and which side downloaded is as the product means it.

transfer.file

string

The file, as the log records it: a full path, or only its name.

transfer.size

string

Its size, as the log records it.

transfer.type

string

How it was moved, as the log records it (through the clipboard, the file manager ...).

session.peer_id

string

The product's ID for the other side - the same whichever host it connects to, so the same ID on several hosts is one remote party.

session.log

string

The log file (and its profile) the session was read from.

transfer.ran

string

Runs of a program with the transferred file's name, after the transfer (Executions' records) - by name, so a lead to confirm by path.
derived: by the RemoteAccess module

transfer.in_period

bool

true when it happened inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the RemoteAccess module

Kind

State - something true when Signal read the host

Built-in rules reading it

6

remote.path_kind

string

Which of Windows' own ways in a setting is: a port forward (netsh portproxy), an SSH key authorized for the administrators or a user, a WinRM listener, WinRM accepting unencrypted traffic, the WinRM client trusting every host, Remote Assistance (offered or solicited help), Remote Desktop shadowing without consent.

remote.path_value

string

The setting, as configured: a forward's listening and target address and port, a key's type, comment and SHA-256 fingerprint (never the key), a listener's address and transport, a value's data.

remote.path_detail

string

What the setting allows, in words, and its options (an authorized key's restrictions, the WinRM service's state).

remote.path_target_scope

string

For a port forward, the kind of the address it forwards to: public, private, loopback ...
derived: from the forward's target address

remote.path_changed

time

When the key or file holding it was last written - the setting's change or another one beside it.

remote.path_user

string

The account it is for (a user's authorized keys); absent for the machine.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

log.provider

string

The component that wrote a log record (its provider), e.g. "Service Control Manager". One event ID means different things from different providers in the same log - System event 104 is a log clear from Microsoft-Windows-Eventlog and a smart-card reader's status from a driver - so a rule over an ID names its provider too.

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

remote.message

string

The event's message data as the tool wrote it (its data fields joined), read by the catalog's patterns for the product.