What a run leaves on a host
Signal only reads. But starting any program on Windows leaves traces. This is the complete list known for a run - so you can tell Signal's own traces from an intruder's.
What Signal writes
What | When |
|---|---|
The run file | Only where |
A run in | Only when a push was not accepted in time. Removed once the console accepts it; at most 10 runs, none older than 30 days; readable by SYSTEM and Administrators only. |
Nothing else: no service, no registry value, no scheduled task, no shadow copy.
What Windows records about the run
Trace | Why | Avoid or reduce |
|---|---|---|
A process creation (Security 4688, Sysmon 1) | Windows records every process start when auditing is on. | Unavoidable. Signal excludes events written after its own start from its statistics and lists them as its footprint. |
Privilege-use events (4672, 4673, 4703) | Enabling the privilege needed to read the Security log. | Unavoidable; excluded and listed the same way. |
4798 / 4799 (group membership enumerated) | The Users module lists local accounts and the Administrators group. | Leave Users out with |
A Prefetch file, Amcache and ShimCache entries | Windows tracks program launches. | Run from a share: no copy of the program is left on disk. |
WMI provider host started | Protection and Backup query WMI. | An EDR may record it; nothing is written. |
An outbound connection to the console | Only with | Use |
What Signal never does
Reads process memory, injects, or suspends a process.
Contacts a domain controller to query the directory.
Locks a file: locked files are read only without locks or writes.
Downloads a certificate to check a signature.
Mounts or loads other users' registry hives: their files are opened read-only and parsed by Signal itself.