The modules at a glance
Fourteen modules, each answering one question about the host. Run them all with -all, or choose the ones your question needs with -m.
The modules
Module | The question it answers | Rule prefix |
|---|---|---|
What ran on the host, and how was it abused? |
| |
What will run again without anyone starting it? |
| |
How was the host used, and from where? |
| |
Who used the host? |
| |
Can the host's logs be trusted? |
| |
What protects the host from malware, and does it work? |
| |
What does the host listen on and talk to? |
| |
Which remote access tools could reach and control the host? |
| |
What came in through a browser, and what in a browser works for someone else? |
| |
Which sites does the host serve, and do they hold a webshell? |
| |
What software is installed? |
| |
Can the host be recovered, and did someone take that away? |
| |
What did the domain push to this host through Group Policy? |
| |
Is this host in scope of the incident? |
|
Choosing modules for a question
Your question | Run |
|---|---|
"Is this host compromised?" |
|
"What ran, and will it run again?" |
|
"Who got in, and how?" |
|
"Is ransomware being prepared?" |
|
"Does this host hold our indicators?" |
|
A domain controller | Every module except Users (its local account database is the domain's) |
How every module page is laid out
Each module page has the same headings, so you always know where to look:
At a glance - the question, what it reads, what it needs.
What it reads - its sources.
Signals it raises - every rule, with its severity.
How to read it - its telemetry and tables, and what to look at first.
What it can't see - its blind spots.
Try it yourself - a safe exercise, where one is possible.
signal list