Lab: survey your own machine 1.0

Lab: survey your own machine

آخر تحديث 12 نوفمبر 2026
في هذه الصفحة

A safe, hands-on exercise: run Signal on your own machine, read what it says about your auditing, then make one harmless change and watch a signal appear.

Part 1: what can Signal see on your machine?

  1. Run every module

    From an elevated prompt: .\signal.exe live -all -o .\ -v

  2. Find the telemetry

    Open the run file and search for "telemetry". Look for process_creation_audit and commandline_logging.

  3. Answer the question

    Are they on or off? On many home and default machines they are off: Windows does not record process creations at all. That means Executions' process rules could not run - and Signal says so.

PowerShell Read the process-creation audit setting yourself 
auditpol /get /subcategory:"Process Creation"

Part 2: make a signal appear

We will create a scheduled task that runs a harmless command from a user-writable folder, then let Signal find it. Persistence rules look for exactly this kind of entry.

  1. Create a harmless task

    Run the commands below. They write a one-line script that only prints a message into C:\Users\Public - a folder any user can write to - and register a task that would run it at logon.

  2. Run Persistence

    .\signal.exe live -m Persistence -o .\

  3. Find your task

    Open the run and search for SignalLab. Which rule matched it, and what does its focus say to do next?

  4. Clean up

    Delete the task with the second command below.

PowerShell Create the lab task 
Set-Content C:\Users\Public\signal-lab.cmd "@echo Signal lab - harmless"
schtasks /create /tn "SignalLab" /tr "C:\Users\Public\signal-lab.cmd" /sc onlogon
PowerShell Clean up 
schtasks /delete /tn "SignalLab" /f
Remove-Item C:\Users\Public\signal-lab.cmd

Questions to check yourself

Why does a run on an unaudited host look so quiet?

Because the evidence was never recorded. Rules over process creations are not run when no process creation is recorded; the telemetry says auditing was off. A quiet run is only meaningful when the telemetry says the sources were there.

Why does the task's signal name a program and an account as well as the task?

Signal relates every signal to the entities it names: the task (its subject), the program it runs and the account that registered it. Investigating the task's entity shows every signal about any of them.

Next

Learn the core ideas, starting with signals and severities.