What Signal does not read
Where Signal cannot help you, and what to use instead. Read this before you rely on a clean run.
"What you can't see" is half of Signal's answer. This page is that half, for the whole tool.
Out of scope by design
These are deliberate: Signal is a one-minute, read-only survey of what Windows recorded.
Not read | Why it matters | Use instead |
|---|---|---|
Process memory | Injected code, process hollowing, reflectively loaded modules and fileless implants live in memory. Signal sees them only through what a log recorded (a PowerShell script block, a process creation). | A memory acquisition and memory analysis; your EDR's memory scanning. |
The kernel and drivers' behaviour | Rootkits that hide processes, files or keys from Windows' own interfaces hide them from Signal too. Signal sees configured drivers, not what a loaded driver does. | Offline disk analysis, memory analysis. |
Below Windows | Firmware, boot sectors, bootkits. | Firmware and boot integrity tools. |
File content | Signal does not scan files: no YARA, no signatures, no reading of scripts' content. | Your antivirus, a YARA sweep. |
The file system's own records | $MFT, the USN journal, LNK files, jump lists, shellbags: user-activity reconstruction. | A triage collection and timeline tools. |
Shimcache and Amcache | They show a program was present, not that it ran. | A registry parser. |
The directory | Signal never queries Active Directory: objects, permissions, trusts and attributes are not read. | Directory assessment tools, run by your directory team. |
Secrets | Cookies, saved passwords, form data, remote tools' passwords and keys: never read. | - |
Other systems | Linux, macOS, cloud services, identity providers, mail, network devices. | Those systems' own logs. |
Other hosts | Each run reads its own host only. | Run Signal on every host in scope. |
Limited by what Windows recorded
Signal reads only what Windows recorded. Where Windows recorded nothing, Signal cannot know - and says so.
When this is missing | Signal cannot see |
|---|---|
Process Creation auditing (off by default on many hosts) | Past processes, except through Prefetch, BAM and PCA - without command lines. |
Command-line logging | Command lines of past processes. |
PowerShell Script Block Logging | What PowerShell ran, except what history files and transcripts hold. |
Prefetch (off by default on Windows Server) | Program runs from Prefetch. |
Connection auditing, Sysmon, or the firewall's log | Past network connections. |
Logon auditing | Logons and failures. |
Security auditing of service installation and task changes | Who installed a service or created a task. |
A long enough log | Anything older than the log's window - unless a shadow copy still holds it ( |
Limited by Signal's lists
Auto-start locations: broad, but not every way Windows can start a program.
Remote access tools: products in Signal's catalog are found by name, even renamed; a product not in it is found only through its process, connections and persistence.
Browsers and web servers: those listed on What Signal reads.
Antivirus: Microsoft Defender in depth; other products through Windows Security Center only.