Offline and isolated hosts
Signal needs no network to survey a host. Here is how to run it on a host that is offline, isolated by your EDR, or in an air-gapped network.
What needs the network
Action | Network? |
|---|---|
| None |
| The share only |
| Signal Console only |
Signature checks | None - verification uses only what the host holds, and never downloads a certificate |
| One request to intrusion.academy for the latest version number |
An isolated or offline host
-
Bring Signal in
On a USB drive, or through your EDR's live response (which still works while the EDR isolates the host).
-
Run it to a local folder
signal live -all -o C:\Windows\Temp\from an elevated prompt. -
Bring the run out
Through the same channel, then import it into Signal Console by hand (Import page).
-
Clean up
Delete the run file and the program copy from the host.
An air-gapped network
Run Signal Console inside the network; push to it as usual (Pro), or import the runs by hand.
Update both without Internet access: request the new
signal.exeon a connected machine, check its SHA-256 and carry it in; Signal Console's signed update package is accepted by upload in Settings, Updates.