FAQ
The questions analysts ask most.
Does Signal change anything on the host?
No. It only reads, and writes only its own run where you tell it. Windows itself records that a program started; see What a run leaves on a host.
Why does it need an elevated prompt?
Without elevation it cannot read the Security log, other users' hives, service and process details or Defender's exclusions. A half-blind run would look clean where it could not see, so it refuses to run.
How long does a run take?
About a minute or less on a typical host - 8 to 9 seconds on a 12-CPU machine, about 30 seconds on one core at idle priority. Hosts with large logs and many profiles take longer.
My run has no signals. Is the host clean?
Only if Signal could see. Check the telemetry and LogIntegrity first. See When to rely on Signal.
Why is a rule "not run" instead of "clear"?
Because its data was missing: a policy off, a source not read, or the profile suppressed it. Unknown is never "no".
Does Signal need Internet access?
No. A survey reaches the network only to push to your console, or to write to a share. Signature checks never download anything.
Can I use Sigma rules?
Not directly. Signal's rules name Signal's own fields and evidence types, and use three-valued logic. Rewriting a Sigma rule in Signal's format is usually straightforward: see Rule syntax.
Does Signal detect malware in files?
No - it does not scan file content. It tells you where a program is, whether it is signed, what started it and what keeps it running.
Can I run it on a domain controller?
Yes, every module except Users, whose local account database is the domain's there. The Directory module adds a domain controller's own records.
Will my antivirus flag it?
It may: it is new, rarely seen and reads sensitive places. Allow it by hash - never by path, and never by turning protection off. See Antivirus and EDR.
What does the run contain? Is it sensitive?
Account names, command lines, paths and addresses. Treat it like evidence. It never contains passwords, cookies or the secrets remote tools store.