Running at scale
On this page
Any tool that can copy a file to a host, run it elevated and bring a file back can run Signal across a fleet. Here is how to choose one, and how to collect the runs.
Every option runs the same command:
signal.exe live -all -o <file or folder> [-profile <file>] [-shadow newest]The options
Option | Runs as | Credentials on the host | Run comes back | Best for |
|---|---|---|---|---|
Velociraptor | SYSTEM | None | Uploaded to the server | A hunt across the fleet |
EDR live response (Defender for Endpoint, CrowdStrike, SentinelOne) | SYSTEM | None | The EDR's file download | One host or a handful during an incident |
SCCM / Intune script | SYSTEM | None |
| A planned sweep |
GPO scheduled task | SYSTEM | None | A share | The domain, at the next refresh |
WinRM / PowerShell remoting | The remote administrator | Network logon | The session | Tens to hundreds of hosts |
PsExec-style service push | SYSTEM | The password is sent; a service is installed | A share | Discouraged |
Recommended order
-
Velociraptor, where it is deployed
No credentials, SYSTEM, the tool hash-checked from the server, the profile as a parameter, every finding as a row. A Velociraptor artifact for Signal ships with it.
-
The EDR's live response
For one host or a few, where Velociraptor is not deployed.
-
SCCM or Intune
For a planned sweep with
-pushto Signal Console. -
WinRM or a GPO task
Only where none of these exists.
Collecting runs on a share
-o \\server\signal$\runs\ writes <host>-<run id>.json into the folder. The file is written under a temporary name and renamed when complete, so collect only *.json. The folder is checked before the survey starts.
Run as SYSTEM, Signal reaches the share as the computer account. Set the rights so a host can drop its run but never read another's:
Who | Share | NTFS on the folder |
|---|---|---|
Domain Computers | Change | Create files / write data (no read, no list) |
The analysts' group | Read | Read & execute |
Everyone else | None | None |
Pushing from a whole fleet
When many hosts push at once, Signal Console accepts 8 at a time by default and asks the rest to wait. Nothing is lost:
Each push keeps trying for
-push-wait(10 minutes), spreading out at random.A run still not accepted waits in the host's outbox (
%ProgramData%\Signal\outbox, readable by SYSTEM and Administrators only; the newest 10, for 30 days) and goes with the host's next push.signal pushdelivers the outbox with no survey - run it hourly as SYSTEM; it exits at once when the outbox is empty.
signal.exe push -push https://console:7446 -push-key-file C:\ProgramData\Signal\push.keysignal.exe push -push https://console:7446 -push-key-file push.key \\server\signal$\runs\Push and the corporate network
On Windows, a push goes through WinHTTP, the HTTP stack Windows' own services use. It follows the host's proxy settings and trusts the Windows certificate store - so an internally issued certificate, or a TLS-inspecting proxy your organisation trusts, works with no extra setup.