Persistence

Kind

Event - something that happened at a time

Its time is

service installed (event logged)

Built-in rules reading it

3

service.name

string

A service's name as the event records it: its display name in a service installation (7045), a start-type change (7040) and a state change (7036).

service.image_path

string

What a service runs: its executable or driver file, with any arguments, as installed (7045's ImagePath) or configured. A driver configured with none is loaded from System32\drivers\<key>.sys - written so.

service.program

string

The program a service runs - service.image_path without its arguments - e.g. C:\Windows\System32\cmd.exe for "cmd.exe /c ...". Where a program is is a fact about it; an argument naming a folder is not.
derived: taken by Signal from service.image_path: the quoted path, else the path up to its first .exe/.sys/.dll ending a word, else up to the first space

service.type

string

The kind of service installed: user mode service, kernel mode driver, file system driver... - as System 7045 words it (possibly in the host's display language), or named by Signal in English from Security 4697's code.

service.start_type

string

When a service starts: auto start, demand start, disabled, boot start, system start - as installed (System 7045's words, possibly in the host's display language, or named by Signal in English from Security 4697's code), or as changed to (7040).

service.account

string

The account a service was installed to run as (7045), e.g. LocalSystem.

service.installed

time

When a service was installed (the installation event's time).

service.sources

string

Which logs recorded a service installation: "System 7045", "Security 4697", or both. Every installation is in the System log; the Security log has it only when Security System Extension auditing is on, and then adds who installed it.
derived: set by Signal when it merges the two events of one installation (the same image path - program and arguments - within 2 seconds)

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_sid

string

The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

Kind

State - something true when Signal read the host

Built-in rules reading it

6

service.name

string

A service's name as the event records it: its display name in a service installation (7045), a start-type change (7040) and a state change (7036).

service.key

string

A service's registry key name (HKLM\SYSTEM\CurrentControlSet\Services\<key>) - stable whatever its display name; a start-type change (7040) records it.

service.image_path

string

What a service runs: its executable or driver file, with any arguments, as installed (7045's ImagePath) or configured. A driver configured with none is loaded from System32\drivers\<key>.sys - written so.

service.program

string

The program a service runs - service.image_path without its arguments - e.g. C:\Windows\System32\cmd.exe for "cmd.exe /c ...". Where a program is is a fact about it; an argument naming a folder is not.
derived: taken by Signal from service.image_path: the quoted path, else the path up to its first .exe/.sys/.dll ending a word, else up to the first space

service.dll

string

For a service that shares svchost.exe, the DLL it loads (its ServiceDll) - the code that actually runs, since the program is svchost.exe for all of them. As configured (unexpanded, e.g. %SystemRoot%\System32\wevtsvc.dll).

service.type

string

The kind of service installed: user mode service, kernel mode driver, file system driver... - as System 7045 words it (possibly in the host's display language), or named by Signal in English from Security 4697's code.

service.start_type

string

When a service starts: auto start, demand start, disabled, boot start, system start - as installed (System 7045's words, possibly in the host's display language, or named by Signal in English from Security 4697's code), or as changed to (7040).

service.account

string

The account a service was installed to run as (7045), e.g. LocalSystem.

service.state

string

A configured service's state now (the live service table, in English), or the state a service entered (7036): running, stopped... possibly in the host's display language. Current Windows builds may write few or none (a Windows 11 host's whole System log held no Service Control Manager 7036), so the absence of one never means a service did not stop.

service.pid

int

The process a running service runs in, now.

persist.modified

time

When the registry key holding the entry was last written, or the file last modified - for a key with several values, the last change to any of them.

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

State - something true when Signal read the host

Built-in rules reading it

5

task.path

string

A scheduled task's path in the Task Scheduler library, \Folder\Name - the same in its registry entry, its XML file, its events and the Task Scheduler's own list.

persist.command

string

What the entry runs, exactly as configured (environment variables unexpanded); a task's actions joined by "; ".

persist.program

string

The program the entry runs - its command without arguments, environment variables expanded for the user whose entry it is.
derived: taken by Signal from persist.command (as service.program is from an image path), expanded with that user's profile

task.author

string

The author the task's definition names - written by whoever registered it, so a claim, not proof.

task.run_as

string

The account or group the task runs as (its principal), as its definition names it - a SID or a name.

task.registered

string

The registration date the task's definition records - written by whoever registered it.

task.triggers

string

When the task runs, each trigger in words, separated by "; ": at startup, at logon (of whom), on a session change, once, daily, weekly or monthly from a time, on an event (its query), when idle, when registered - with its delay, repetition and whether it is disabled. Read from the task's XML file; absent when only the TaskCache entry exists.

task.hidden

string

How the task is hidden, if at all: "no security descriptor" (its TaskCache entry lacks SD - hidden from schtasks and the Task Scheduler window), "no XML file", "not listed by the Task Scheduler", "Hidden setting" (its own, harmless flag) - joined by "; ".
derived: set by Signal by comparing the task's sources

persist.sources

string

Every source the entry was read from, e.g. "TaskCache registry, task XML file, Task Scheduler (WMI)".
derived: set by Signal when it merges the sources of one entry

persist.modified

time

When the registry key holding the entry was last written, or the file last modified - for a key with several values, the last change to any of them.

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

task.path

string

A scheduled task's path in the Task Scheduler library, \Folder\Name - the same in its registry entry, its XML file, its events and the Task Scheduler's own list.

task.change

string

What an event says happened to a task: registered, updated, deleted, enabled, disabled.
derived: named by Signal from the event ID (Security 4698-4702, TaskScheduler 106, 140, 141)

persist.command

string

What the entry runs, exactly as configured (environment variables unexpanded); a task's actions joined by "; ".

persist.program

string

The program the entry runs - its command without arguments, environment variables expanded for the user whose entry it is.
derived: taken by Signal from persist.command (as service.program is from an image path), expanded with that user's profile

log.event_time

time

When a log record was written (its TimeCreated).

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_sid

string

The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

persist.sources

string

Every source the entry was read from, e.g. "TaskCache registry, task XML file, Task Scheduler (WMI)".
derived: set by Signal when it merges the sources of one entry

Kind

State - something true when Signal read the host

Built-in rules reading it

19

persist.location

string

The kind of auto-start place: Run, RunOnce, Winlogon, Logon script, IFEO Debugger, SilentProcessExit, LSA package, AppInit DLLs, COM override, Startup folder, PowerShell profile, BootExecute... - or Service, Scheduled task, WMI subscription in the persistence inventory.

persist.entry

string

What the entry is configured under: the registry value's name, the file's name, the program an IFEO key is for, the LSA package's name, the COM class ID.

persist.where

string

The registry key (HKLM\..., HKU\<SID>\...) or folder the entry was read from.

persist.command

string

What the entry runs, exactly as configured (environment variables unexpanded); a task's actions joined by "; ".

persist.program

string

The program the entry runs - its command without arguments, environment variables expanded for the user whose entry it is.
derived: taken by Signal from persist.command (as service.program is from an image path), expanded with that user's profile

persist.user

string

Whose entry it is, for a per-user place: the profile folder's name and SID. Empty for the machine's.

persist.modified

time

When the registry key holding the entry was last written, or the file last modified - for a key with several values, the last change to any of them.

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

bits.job_id

string

The BITS job's ID - one job's events share it.

bits.title

string

The job's title, as the program that created it named it.

bits.owner

string

The account that owns the job - it runs as this account.

bits.client

string

The program that created the job (event 3's processPath). Absent when the job was created before the log's window.

bits.url

string

The URLs the job transferred, separated by " / " (events 59 and 60).

bits.file

string

The file name each URL ends in (its last path element, the query left out), separated by " / " - what the job brought.
derived: taken by Signal from bits.url

bits.url_scope

string

When a URL's host is an IP address rather than a name: its scope (public, private, loopback...). Absent for a host name.
derived: decided by Signal from bits.url (entity.AddressScope)

bits.result

string

How the transfer ended, as event 60 records it: "completed" (result 0), or the error code; "completed" also when event 4 recorded the job's completion.

bits.events

string

The Bits-Client events this job's record merges, e.g. "3 created, 59 transfer started, 60 transfer stopped, 4 completed". A job's notify command (what it runs when it ends) is in no event - only in BITS's own queue, which Signal does not read.

log.event_time

time

When a log record was written (its TimeCreated).