Antivirus and EDR
On this page
Signal is read-only and does nothing malicious, but security products may flag it. Allow it by hash before a fleet run - and never turn protection off to run it.
Why it may be flagged
Signal is a new, rarely seen executable that reads what credential theft also touches: the SAM and SECURITY hives' keys, LSA settings, the Security log, other users' registry hives, every process's details. Expect:
Reputation and machine-learning detections of a binary never seen before (SmartScreen, cloud reputation).
Behaviour alerts in an EDR: reads of sensitive registry keys, many processes opened for query. These are alerts on reads, not blocks.
No signature detection is expected: the rule text, which names attack tools, is stored compressed rather than as plain strings.
Allow it by hash
Product | Where | What to allow |
|---|---|---|
Microsoft Defender Antivirus / Defender for Endpoint | Settings > Endpoints > Indicators > File hashes - Allow | The release's SHA-256 |
CrowdStrike Falcon | Endpoint security > IOC management - Allow | The SHA-256 |
SentinelOne | Sentinels > Exclusions > Hash | The SHA-1 or SHA-256 |
Others | A hash or certificate exclusion | The SHA-256 |
What an EDR will see
Signal opens processes for limited query only - no memory read, no injection, no suspension, and no debug privilege. It reads the registry and files, and queries WMI and the Service Control Manager. An EDR may record these reads; Signal writes nothing.
The full list is on What a run leaves on a host.