Signal docs 1.0

What's new in 1.0

Signal 1.0 is the first public release: a one-minute, read-only survey of a Windows host, and Signal Console to triage a fleet.

In this release

  • 14 modules: Executions, Persistence, Logons, Users, LogIntegrity, Protection, Network, RemoteAccess, Browsers, Webshells, Applications, Backup, Directory and Scope.

  • 211 built-in rules: 193 pattern rules, each tested against the records it must match and the look-alikes it must not, and 18 rules over a run's facts; tagged with ATT&CK 20.0 where a technique applies.

  • Scoping profiles: a window, module parameters, suppressions, a baseline and pivot points.

  • Shadow copies as evidence with -shadow.

  • Your own rules with -rules, checked by signal rules -check.

  • Push to Signal Console, with an outbox so no run is lost.

  • Update check with signal update: it says when a new version is out; you request it on the website.

This is the first version of these docs: every page is new.