الدقيقة الأولى في كل تحقيق.

PS C:\IR> .\signal.exe live -all -v -o host.json

1. 17ms INFO Signal 1.0.0 - modules: Applications, Backup, Browsers, Directory, Executions, LogIntegrity, Logons, Network, Persistence, Protection, RemoteAccess, Scope, Users, Webshells
2. 17ms INFO settings: 12 logical CPU(s); 8 render thread(s) per log (chosen for this machine); 6 module(s) at a time (chosen for this machine); no time limit - every step runs to its end (Ctrl+C stops the run)
3. 17ms · below-normal CPU priority: on a busy host the host's own work is scheduled first
4. 25ms INFO host - Windows 11 Pro, build 26200.9711, workstation; running as
5. 48ms · Webshells: waits for the web servers and the process table and the Security log and the Microsoft-Windows-Windows Defender/Operational log and the Microsoft-Windows-Sysmon/Operational log
6. 48ms INFO Microsoft-Windows-CodeIntegrity/Operational log: reading for Protection - event IDs 3076, 3077, 8 render thread(s)
7. 48ms INFO Application log: reading for Applications, RemoteAccess - every event, 8 render thread(s)
8. 48ms INFO PowerShellCore/Operational log: reading for Directory, Executions - event IDs 4103, 4104, 8 render thread(s)
9. 48ms INFO Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log: reading for Logons - event IDs 1149, 8 render thread(s)
10. 48ms · Protection: waits for the antivirus state and the persistence and the Microsoft-Windows-Windows Defender/Operational log and the Microsoft-Windows-CodeIntegrity/Operational log and the Microsoft-Windows-AppLocker/EXE and DLL log and the Microsoft-Windows-AppLocker/MSI and Script log and the Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log
11. 48ms INFO Microsoft-Windows-GroupPolicy/Operational log: reading for LogIntegrity - event IDs 5016, 6016, 7016, 8 render thread(s)
12. 48ms INFO Microsoft-Windows-AppLocker/MSI and Script log: reading for Protection - event IDs 8006, 8007, 8 render thread(s)
13. 48ms INFO Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log: reading for Logons - event IDs 21, 22, 23, 24, 25, 8 render thread(s)
14. 48ms INFO Microsoft-Windows-TaskScheduler/Operational log: reading for Persistence - event IDs 106, 140, 141, 8 render thread(s)
15. 48ms · Browsers: waits for the browsers and the program runs and the process table and the persistence and the service table and the Security log and the Microsoft-Windows-Sysmon/Operational log
16. 48ms INFO browsers: reading for Browsers, RemoteAccess
17. 48ms INFO persistence: reading for Browsers, Persistence, Protection, RemoteAccess
18. 48ms INFO account records: reading for Users
19. 48ms INFO web servers: reading for Webshells
20. 48ms INFO installed applications: reading for Applications
21. 48ms INFO service table: reading for Backup, Browsers, Persistence
22. 48ms INFO program runs: reading for Browsers, Directory, Executions, RemoteAccess
23. 48ms · Applications: waits for the installed applications and the Application log
24. 48ms INFO recovery state: reading for Backup
25. 48ms · Backup: waits for the recovery state and the service table and the Microsoft-Windows-Backup log and the System log
26. 48ms INFO Microsoft-Windows-Sysmon/Operational log: reading for Browsers, Directory, Executions, Network, Persistence, RemoteAccess, Webshells - event IDs 1, 3, 19, 20, 21, 8 render thread(s)
27. 48ms INFO OpenSSH/Operational log: reading for RemoteAccess - event IDs 4, 8 render thread(s)
28. 48ms INFO Microsoft-Windows-WMI-Activity/Operational log: reading for Executions, Persistence - event IDs 5857, 5858, 5860, 5861, 8 render thread(s)
29. 48ms INFO Microsoft-Windows-Backup log: reading for Backup - event IDs 4, 5, 14, 161, 8 render thread(s)
30. 48ms INFO Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log: reading for Logons - event IDs 131, 140, 8 render thread(s)
31. 67ms · protection block (historical): 28 records
32. 67ms OK Microsoft-Windows-CodeIntegrity/Operational log: 28 events read in 19ms (1,463 a second)
33. 48ms INFO Microsoft-Windows-WinRM/Operational log: reading for Executions - event IDs 6, 91, 8 render thread(s)
34. 48ms INFO Microsoft-Windows-PowerShell/Operational log: reading for Directory, Executions - event IDs 4103, 4104, 8 render thread(s)
35. 48ms INFO Microsoft-Windows-TerminalServices-RDPClient/Operational log: reading for Logons - event IDs 1024, 1102, 8 render thread(s)
36. 48ms INFO process table: reading for Browsers, Executions, Webshells
37. 48ms INFO group policy: reading for Directory
38. 48ms INFO network: reading for Network
39. 48ms · Network: waits for the network and the Security log and the Microsoft-Windows-Sysmon/Operational log
40. 48ms INFO antivirus state: reading for Protection
41. 48ms INFO remote access tools: reading for RemoteAccess
42. 48ms · LogIntegrity: waits for the Security log and the System log and the Microsoft-Windows-GroupPolicy/Operational log
43. 48ms · Executions: waits for the process table and the program runs and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-PowerShell/Operational log and the PowerShellCore/Operational log and the Windows PowerShell log and the Microsoft-Windows-WMI-Activity/Operational log and the Microsoft-Windows-WinRM/Operational log
44. 48ms INFO Microsoft-Windows-Windows Defender/Operational log: reading for Protection, Webshells - event IDs 1009, 1116, 1117, 1118, 1119, 1121, 1122, 1123, 1124, 1125, 1126, 2001, 2003, 2006, 3002, 5000, 5001, 5004, 5007, 5010, 5012, 5013, 8 render thread(s)
45. 48ms INFO Microsoft-Windows-AppLocker/EXE and DLL log: reading for Protection - event IDs 8003, 8004, 8 render thread(s)
46. 48ms INFO Scope: running
47. 48ms INFO Windows PowerShell log: reading for Directory, Executions - event IDs 400, 800, 8 render thread(s)
48. 48ms · Directory: waits for the group policy and the program runs and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-PowerShell/Operational log and the PowerShellCore/Operational log and the Windows PowerShell log
49. 48ms INFO Security log: reading for Browsers, Directory, Executions, LogIntegrity, Logons, Network, Persistence, RemoteAccess, Users, Webshells - every event, 8 render thread(s)
50. 48ms INFO System log: reading for Backup, LogIntegrity, Persistence - event IDs 25, 36, 104, 6005, 6006, 6008, 7036, 7040, 7045, 8 render thread(s)
51. 48ms INFO Microsoft-Windows-Bits-Client/Operational log: reading for Persistence - event IDs 3, 4, 59, 60, 8 render thread(s)
52. 48ms · Users: waits for the account records and the Security log
53. 48ms · Persistence: waits for the service table and the persistence and the System log and the Security log and the Microsoft-Windows-TaskScheduler/Operational log and the Microsoft-Windows-WMI-Activity/Operational log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-Bits-Client/Operational log
54. 48ms INFO Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log: reading for Protection - event IDs 2033, 2059, 8 render thread(s)
55. 48ms · Logons: waits for the Security log and the Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log and the Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log and the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log and the Microsoft-Windows-TerminalServices-RDPClient/Operational log
56. 48ms · RemoteAccess: waits for the remote access tools and the program runs and the browsers and the persistence and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Application log and the OpenSSH/Operational log
57. 55ms WARN PowerShell script block (historical): unavailable - the PowerShellCore/Operational log does not exist on this host
58. 55ms · protection block (historical): 0 records
59. 62ms · Remote Desktop Services record (historical): 0 records
60. 66ms · remote access tool's event (Windows event log): 0 records
61. 72ms WARN Group Policy object (now): unavailable - this host is not joined to a domain
62. 75ms · WinRM session (historical): 5 records
63. 79ms · Windows Backup operation (historical): 0 records
64. 81ms · Remote Desktop Services record (historical): 0 records
65. 81ms · Remote Desktop client connection (historical): 17 records
66. 86ms · Group Policy extension run (historical): 0 records
67. 110ms OK Scope: analysed in 7ms - 0 signal(s); 1 rules: 0 flagged, 0 clear, 1 not run
68. 125ms WARN PowerShellCore/Operational log: stopped early after 6ms with 0 events read - EvtQuery(PowerShellCore/Operational): this event log does not exist on this host
69. 137ms · local account (now): 7 records
70. 154ms OK OpenSSH/Operational log: 0 events read in 2ms (0 a second)
71. 161ms OK Microsoft-Windows-Backup log: 0 events read in 14ms (0 a second)
72. 161ms OK Microsoft-Windows-TerminalServices-RDPClient/Operational log: 17 events read in 10ms (1,632 a second)
73. 163ms · local administrator (now): 2 records
74. 164ms OK Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log: 0 events read in 14ms (0 a second)
75. 162ms WARN Group Policy setting (now): unavailable - this host is not joined to a domain
76. 181ms · antivirus protection event (historical): 2 records
77. 162ms OK Microsoft-Windows-AppLocker/MSI and Script log: 0 events read in 6ms (0 a second)
78. 191ms OK Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log: 0 events read in 14ms (0 a second)
79. 191ms · Scope: SCOPE-PIVOT-HIT not run - the run's profile gives no pivot points
80. 213ms OK Microsoft-Windows-WinRM/Operational log: 5 events read in 5ms (1,097 a second)
81. 213ms OK Microsoft-Windows-GroupPolicy/Operational log: 0 events read in 37ms (0 a second)
82. 214ms · protection block (historical): 0 records
83. 220ms WARN file in SYSVOL (now): unavailable - this host is not a domain controller
84. 233ms · user profile (on disk): 6 records
85. 233ms · WMI activity (historical): 1,336 records
86. 234ms · Remote Desktop Services record (historical): 16 records
87. 238ms INFO Remote Desktop Services record (historical): needs Remote Desktop connections allowed, which is off on this host
88. 238ms OK Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log: 16 events read in 17ms (925 a second)
89. 238ms OK Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log: 2 events read in 59ms (33 a second)
90. 238ms OK Microsoft-Windows-AppLocker/EXE and DLL log: 0 events read in 58ms (0 a second)
91. 238ms OK group policy: 0 records read in 167ms
92. 239ms · signed in (now): 1 records
93. 239ms OK account records: 16 records read in 189ms
94. 242ms · WMI subscription registered (historical): 0 records
95. 247ms OK Microsoft-Windows-WMI-Activity/Operational log: 1,336 events read in 169ms (7,914 a second)
96. 248ms · PowerShell script block (historical): 7 records
97. 249ms · PowerShell engine start (historical): 158 records
98. 249ms OK Windows PowerShell log: 165 events read in 143ms (1,153 a second)
99. 371ms · BITS transfer job (historical): 799 records
100. 373ms OK Microsoft-Windows-Bits-Client/Operational log: 799 events read in 249ms (3,203 a second)
101. 377ms · recovery mechanism (now): 5 records
102. 378ms OK recovery state: 5 records read in 327ms
103. 379ms · application installed or removed (Windows Installer): 249 records
104. 380ms · remote access tool's event (Windows event log): 16,376 records
105. 381ms OK Application log: 16,376 events read in 331ms (49,495 a second)
106. 382ms · shadow copies lost (volsnap, historical): 0 records
107. 382ms · System log record: 1,121 records
108. 382ms · service installation (historical): 94 records
109. 383ms OK System log: 1,576 events read in 256ms (6,151 a second)
110. 393ms · antivirus detection (historical): 115 records
111. 395ms · antivirus protection event (historical): 2,231 records
112. 395ms · protection block (historical): 0 records
113. 395ms OK Microsoft-Windows-Windows Defender/Operational log: 2,346 events read in 280ms (8,371 a second)
114. 395ms · PowerShell script block (historical): 1,445 records
115. 395ms INFO PowerShell script block (historical): needs PowerShell module logging, which is off on this host
116. 395ms OK Microsoft-Windows-PowerShell/Operational log: 1,445 events read in 326ms (4,438 a second)
117. 405ms · scheduled task change (historical): 2,855 records
118. 406ms OK Microsoft-Windows-TaskScheduler/Operational log: 2,855 events read in 355ms (8,047 a second)
119. 421ms · installed application (now): 637 records
120. 424ms OK installed applications: 637 records read in 374ms
121. 425ms INFO Applications: running
122. 430ms OK Applications: analysed in 4ms - 0 signal(s); 4 rules: 0 flagged, 4 clear, 0 not run
123. 553ms · process creation (historical): 3,018 records
124. 560ms · network connection (historical): 4,273 records
125. 561ms · WMI subscription registered (historical): 0 records
126. 561ms OK Microsoft-Windows-Sysmon/Operational log: 7,291 events read in 489ms (14,912 a second)
127. 833ms · process creation (historical): 5,686 records
128. 834ms · Security log record: 22,340 records
129. 837ms · logon (historical): 588 records
130. 838ms · failed logon (historical): 0 records
131. 839ms · explicit credentials (historical): 23 records
132. 840ms · administrative logon (historical): 567 records
133. 841ms · Remote Desktop Services record (historical): 0 records
134. 841ms · network connection (historical): 0 records
135. 841ms INFO network connection (historical): needs Filtering Platform Connection auditing, which is off on this host
136. 842ms · service installation (historical): 54 records
137. 842ms · scheduled task change (historical): 541 records
138. 843ms OK Security log: 22,340 events read in 704ms (31,743 a second)
139. 843ms INFO LogIntegrity: running
140. 847ms INFO Users: running
141. 847ms INFO Logons: running
142. 849ms OK Logons: analysed in 1ms - 0 signal(s); 11 rules: 0 flagged, 11 clear, 0 not run
143. 851ms OK Users: analysed in 3ms - 1 signal(s); 11 rules: 1 flagged, 10 clear, 0 not run
144. 883ms OK LogIntegrity: analysed in 39ms - 8 signal(s); 10 rules: 4 flagged, 6 clear, 0 not run
145. 947ms · antivirus product (now): 1 records
146. 948ms · Windows protection (now): 15 records
147. 948ms · antivirus detection history (now): 4 records
148. 948ms · antivirus status (now): 1 records
149. 949ms · antivirus exclusion (now): 7 records
150. 949ms OK antivirus state: 28 records read in 867ms
151. 983ms · browser extension (now): 44 records
152. 984ms · file downloaded (browser history, Mark of the Web): 79 records
153. 984ms · site visited (browser history): 500 records
154. 984ms OK browsers: 623 records read in 934ms
155. 1.1s · program run (historical): 2,317 records
156. 1.1s · PowerShell history (in a user's history file now): 3,469 records
157. 1.1s · PowerShell transcript (in a transcript file now): 0 records
158. 1.1s INFO PowerShell transcript (in a transcript file now): needs PowerShell transcription, which is off on this host
159. 1.1s OK program runs: 5,786 records read in 1.05s
160. 1.14s INFO Directory: running
161. 1.14s OK Directory: analysed in <1ms - 0 signal(s); 25 rules: 0 flagged, 1 clear, 24 not run
162. 1.14s · Directory: DIR-RC4-SERVICE-TICKETS not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
163. 1.14s · Directory: DIR-TICKETS-WITHOUT-PREAUTH not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
164. 1.14s · Directory: DIR-PASSWORD-SPRAY not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
165. 1.14s · Directory: DIR-PASSWORD-GUESSING not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
166. 1.14s · Directory: DIR-GPO-IMMEDIATE-TASK not run - this host is not joined to a domain
167. 1.14s · Directory: DIR-GPO-TASK-FROM-SHARE not run - this host is not joined to a domain
168. 1.14s · Directory: DIR-GPO-RUNS-FROM-USER-FOLDER not run - this host is not joined to a domain
169. 1.14s · Directory: DIR-GPO-COMMAND-WITH-URL not run - this host is not joined to a domain
170. 1.14s · Directory: DIR-GPO-COPIES-EXECUTABLE not run - this host is not joined to a domain
171. 1.14s · Directory: DIR-GPO-DEFENDER-POLICY-OFF not run - this host is not joined to a domain
172. 1.14s · Directory: DIR-GPO-DEFENDER-EXCLUSION not run - this host is not joined to a domain
173. 1.14s · Directory: DIR-GPO-RECOVERY-SERVICE-OFF not run - this host is not joined to a domain
174. 1.14s · Directory: DIR-GPO-LOCAL-ADMIN-MEMBER not run - this host is not joined to a domain
175. 1.14s · Directory: DIR-GPO-STORED-PASSWORD not run - this host is not joined to a domain
176. 1.14s · Directory: DIR-GPO-DEPLOYS-CODE-IN-PERIOD not run - no period was given (the profile's window)
177. 1.14s · Directory: DIR-GPO-CREATED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
178. 1.14s · Directory: DIR-GPO-LINKED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
179. 1.14s · Directory: DIR-SYSVOL-FILE-IN-PERIOD not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
180. 1.14s · Directory: DIR-SYSVOL-DISGUISED-EXECUTABLE not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
181. 1.14s · Directory: DIR-PRIVILEGED-GROUP-MEMBER-ADDED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
182. 1.14s · Directory: DIR-SENSITIVE-GROUP-MEMBER-ADDED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
183. 1.14s · Directory: DIR-DELEGATION-SET not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
184. 1.14s · Directory: DIR-ADMINSDHOLDER-CHANGED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
185. 1.14s · Directory: DIR-REPLICATION-BY-NON-COMPUTER not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
186. 1.2s WARN web site (configured now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
187. 1.2s WARN server-side script (in a web site's folders now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
188. 1.2s WARN web server module or handler (configured now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
189. 1.2s OK web servers: 0 records read in 1.15s
190. 1.55s · remote access tool (installed, run or its files): 2 records
191. 1.55s · remote access session (the tool's log): 8 records
192. 1.55s · file transfer (the remote access tool's log): 1 records
193. 1.55s · Windows remote access setting (now): 2 records
194. 1.55s OK remote access tools: 13 records read in 1.46s
195. 1.75s · running process (now): 553 records
196. 1.75s OK process table: 553 records read in 1.68s
197. 1.75s INFO Executions: running
198. 1.75s INFO Webshells: running
199. 1.75s OK Webshells: analysed in <1ms - 0 signal(s); 6 rules: 0 flagged, 1 clear, 5 not run
200. 1.75s · Webshells: WEB-WEBSHELL-HIGH not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
201. 1.75s · Webshells: WEB-WEBSHELL-MEDIUM not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
202. 1.75s · Webshells: WEB-WEBSHELL-LOW not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
203. 1.75s · Webshells: WEB-NATIVE-MODULE-UNUSUAL not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
204. 1.75s · Webshells: WEB-HANDLER-ON-STATIC-TYPE not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
205. 1.85s OK Executions: analysed in 101ms - 3 signal(s); 29 rules: 3 flagged, 26 clear, 0 not run
206. 1.99s · network connection or listener (now): 646 records
207. 1.99s WARN connection in the firewall's log (historical): unavailable - no firewall log file exists
208. 1.99s INFO connection in the firewall's log (historical): needs Windows Firewall logging of allowed connections, which is off on this host
209. 1.99s · network setting (now): 1 records
210. 1.99s · network adapter (now): 11 records
211. 1.99s OK network: 658 records read in 1.91s
212. 1.99s INFO Network: running
213. 1.99s OK Network: analysed in <1ms - 0 signal(s); 12 rules: 0 flagged, 12 clear, 0 not run
214. 2.84s · configured service (now): 779 records
215. 2.84s OK service table: 779 records read in 2.79s
216. 2.84s INFO Backup: running
217. 2.85s OK Backup: analysed in <1ms - 0 signal(s); 7 rules: 0 flagged, 7 clear, 0 not run
218. 3.88s · auto-start entry (now): 95 records
219. 3.88s · scheduled task (now): 277 records
220. 3.88s · WMI subscription (now): 1 records
221. 3.88s OK persistence: 373 records read in 3.83s
222. 3.89s INFO Protection: running
223. 3.89s INFO Browsers: running
224. 3.89s INFO Persistence: running
225. 3.89s INFO RemoteAccess: running
226. 3.9s OK Protection: analysed in 3ms - 17 signal(s); 25 rules: 12 flagged, 13 clear, 0 not run
227. 3.9s OK Persistence: analysed in 7ms - 4 signal(s); 31 rules: 4 flagged, 27 clear, 0 not run
228. 3.95s OK RemoteAccess: analysed in 54ms - 7 signal(s); 23 rules: 5 flagged, 16 clear, 2 not run
229. 3.95s · RemoteAccess: RA-INSTALLED-IN-PERIOD not run - no period was given (the profile's window)
230. 3.95s · RemoteAccess: RA-NOT-ALLOWED not run - no approved list was given (the profile's modules.RemoteAccess.approved_tools): authorization is unknown
231. 4.06s OK Browsers: analysed in 168ms - 15 signal(s); 16 rules: 8 flagged, 7 clear, 1 not run
232. 4.06s · Browsers: BROWSER-DOWNLOAD-IN-PERIOD not run - no period was given (the profile's window)
233. 4.52s OK survey finished in 4.51s - 14 module(s); signals: 18 high · 26 medium · 11 low
234. 4.54s OK wrote host.json (1,496 KB)