Incident response · Compromise assessment · Threat hunt · Gap assessment
DFIR survey - automated triage for Windows hosts

The first minute of every investigation.

Where to look, and what you can't see

A one-minute, read-only survey of 50+ Windows artifacts and data sources that turns them into signals - the few findings worth your time - and names its audit gaps: logging that was off, logs cleared or overwritten, artifacts it could not read.

Download Signal v1.0.1 Get Signal Console Signal Documentation
Run time
~1 min
Size
One file, under 10 MB
Access
Read-only, minimal footprint
Platform
Windows 10 / 11 / Server
Evidence read
50+ artifacts and sources
Production-safe
Below-normal priority: the host's work comes first

DFIR Survey: Automated Triage for Windows Hosts

Incident response has one ultimate question: is this host compromised?

A survey is the first, wide pass over a host. Not a full forensic analysis - a quick look at everything Windows already recorded, to point at what stands out before anyone collects a disk, triage or memory image.

Done by hand, that pass eats hours: collect the artifacts, process every format, then read row after row of normal activity. Signal does all three on the host itself and hands you only what its 200+ rules matched, each with what happened, why it matters and what to do next.

What is Signal?
Time to a first answer, by approach
Full disk image
Many hours to days
Super timeline
6+ hours
Single-artifact timeline
~1 hour
Signal
~1 min
  • Collect Copy a disk, triage or memory image off the host - or the artifacts one by one.
  • Process Parse every format with its own tool, merge the sources and line up their times.
  • Triage Read thousands of mostly normal rows for the few that matter.

The First Minute of Every Investigation

Less than a minute on a typical host: about 4.5 seconds on a 12-CPU machine, about 30 on a single core.

01

Each source read once

Every log and artifact is read a single time and shared by every module that needs it.

02

Many things at once

Modules and log readers work side by side across the host's processors, while one is always left for the host.

03

Conclusions, not piles

Signal keeps only what a rule matched and a few small tables, so there is no mountain of rows to write or sort.

04

Nothing to set up

One signed file. No installer, no agent, no service, no database - it starts reading the moment it starts.

PS C:\IR> .\signal.exe live -all -v -o host.json

Signal 1.0.0 · DFIR Survey: The First Minute of Every Investigation. Where to Look & What You Can't See! Developed and maintained by Intrusion Academy · https://intrusion.academy/signal
  1. INFO Signal 1.0.0 - modules: Applications, Backup, Browsers, Directory, Executions, LogIntegrity, Logons, Network, Persistence, Protection, RemoteAccess, Scope, Users, Webshells
  2. INFO settings: 12 logical CPU(s); 8 render thread(s) per log (chosen for this machine); 6 module(s) at a time (chosen for this machine); no time limit - every step runs to its end (Ctrl+C stops the run)
  3. · below-normal CPU priority: on a busy host the host's own work is scheduled first
  4. INFO host - Windows 11 Pro, build 26200.9711, workstation; running as
  5. · Webshells: waits for the web servers and the process table and the Security log and the Microsoft-Windows-Windows Defender/Operational log and the Microsoft-Windows-Sysmon/Operational log
  6. INFO Microsoft-Windows-CodeIntegrity/Operational log: reading for Protection - event IDs 3076, 3077, 8 render thread(s)
  7. INFO Application log: reading for Applications, RemoteAccess - every event, 8 render thread(s)
  8. INFO PowerShellCore/Operational log: reading for Directory, Executions - event IDs 4103, 4104, 8 render thread(s)
  9. INFO Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log: reading for Logons - event IDs 1149, 8 render thread(s)
  10. · Protection: waits for the antivirus state and the persistence and the Microsoft-Windows-Windows Defender/Operational log and the Microsoft-Windows-CodeIntegrity/Operational log and the Microsoft-Windows-AppLocker/EXE and DLL log and the Microsoft-Windows-AppLocker/MSI and Script log and the Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log
  11. INFO Microsoft-Windows-GroupPolicy/Operational log: reading for LogIntegrity - event IDs 5016, 6016, 7016, 8 render thread(s)
  12. INFO Microsoft-Windows-AppLocker/MSI and Script log: reading for Protection - event IDs 8006, 8007, 8 render thread(s)
  13. INFO Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log: reading for Logons - event IDs 21, 22, 23, 24, 25, 8 render thread(s)
  14. INFO Microsoft-Windows-TaskScheduler/Operational log: reading for Persistence - event IDs 106, 140, 141, 8 render thread(s)
  15. · Browsers: waits for the browsers and the program runs and the process table and the persistence and the service table and the Security log and the Microsoft-Windows-Sysmon/Operational log
  16. INFO browsers: reading for Browsers, RemoteAccess
  17. INFO persistence: reading for Browsers, Persistence, Protection, RemoteAccess
  18. INFO account records: reading for Users
  19. INFO web servers: reading for Webshells
  20. INFO installed applications: reading for Applications
  21. INFO service table: reading for Backup, Browsers, Persistence
  22. INFO program runs: reading for Browsers, Directory, Executions, RemoteAccess
  23. · Applications: waits for the installed applications and the Application log
  24. INFO recovery state: reading for Backup
  25. · Backup: waits for the recovery state and the service table and the Microsoft-Windows-Backup log and the System log
  26. INFO Microsoft-Windows-Sysmon/Operational log: reading for Browsers, Directory, Executions, Network, Persistence, RemoteAccess, Webshells - event IDs 1, 3, 19, 20, 21, 8 render thread(s)
  27. INFO OpenSSH/Operational log: reading for RemoteAccess - event IDs 4, 8 render thread(s)
  28. INFO Microsoft-Windows-WMI-Activity/Operational log: reading for Executions, Persistence - event IDs 5857, 5858, 5860, 5861, 8 render thread(s)
  29. INFO Microsoft-Windows-Backup log: reading for Backup - event IDs 4, 5, 14, 161, 8 render thread(s)
  30. INFO Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log: reading for Logons - event IDs 131, 140, 8 render thread(s)
  31. · protection block (historical): 28 records
  32. OK Microsoft-Windows-CodeIntegrity/Operational log: 28 events read in 19ms (1,463 a second)
  33. INFO Microsoft-Windows-WinRM/Operational log: reading for Executions - event IDs 6, 91, 8 render thread(s)
  34. INFO Microsoft-Windows-PowerShell/Operational log: reading for Directory, Executions - event IDs 4103, 4104, 8 render thread(s)
  35. INFO Microsoft-Windows-TerminalServices-RDPClient/Operational log: reading for Logons - event IDs 1024, 1102, 8 render thread(s)
  36. INFO process table: reading for Browsers, Executions, Webshells
  37. INFO group policy: reading for Directory
  38. INFO network: reading for Network
  39. · Network: waits for the network and the Security log and the Microsoft-Windows-Sysmon/Operational log
  40. INFO antivirus state: reading for Protection
  41. INFO remote access tools: reading for RemoteAccess
  42. · LogIntegrity: waits for the Security log and the System log and the Microsoft-Windows-GroupPolicy/Operational log
  43. · Executions: waits for the process table and the program runs and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-PowerShell/Operational log and the PowerShellCore/Operational log and the Windows PowerShell log and the Microsoft-Windows-WMI-Activity/Operational log and the Microsoft-Windows-WinRM/Operational log
  44. INFO Microsoft-Windows-Windows Defender/Operational log: reading for Protection, Webshells - event IDs 1009, 1116, 1117, 1118, 1119, 1121, 1122, 1123, 1124, 1125, 1126, 2001, 2003, 2006, 3002, 5000, 5001, 5004, 5007, 5010, 5012, 5013, 8 render thread(s)
  45. INFO Microsoft-Windows-AppLocker/EXE and DLL log: reading for Protection - event IDs 8003, 8004, 8 render thread(s)
  46. INFO Scope: running
  47. INFO Windows PowerShell log: reading for Directory, Executions - event IDs 400, 800, 8 render thread(s)
  48. · Directory: waits for the group policy and the program runs and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-PowerShell/Operational log and the PowerShellCore/Operational log and the Windows PowerShell log
  49. INFO Security log: reading for Browsers, Directory, Executions, LogIntegrity, Logons, Network, Persistence, RemoteAccess, Users, Webshells - every event, 8 render thread(s)
  50. INFO System log: reading for Backup, LogIntegrity, Persistence - event IDs 25, 36, 104, 6005, 6006, 6008, 7036, 7040, 7045, 8 render thread(s)
  51. INFO Microsoft-Windows-Bits-Client/Operational log: reading for Persistence - event IDs 3, 4, 59, 60, 8 render thread(s)
  52. · Users: waits for the account records and the Security log
  53. · Persistence: waits for the service table and the persistence and the System log and the Security log and the Microsoft-Windows-TaskScheduler/Operational log and the Microsoft-Windows-WMI-Activity/Operational log and the Microsoft-Windows-Sysmon/Operational log and the Microsoft-Windows-Bits-Client/Operational log
  54. INFO Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log: reading for Protection - event IDs 2033, 2059, 8 render thread(s)
  55. · Logons: waits for the Security log and the Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log and the Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log and the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log and the Microsoft-Windows-TerminalServices-RDPClient/Operational log
  56. · RemoteAccess: waits for the remote access tools and the program runs and the browsers and the persistence and the Security log and the Microsoft-Windows-Sysmon/Operational log and the Application log and the OpenSSH/Operational log
  57. WARN PowerShell script block (historical): unavailable - the PowerShellCore/Operational log does not exist on this host
  58. · protection block (historical): 0 records
  59. · Remote Desktop Services record (historical): 0 records
  60. · remote access tool's event (Windows event log): 0 records
  61. WARN Group Policy object (now): unavailable - this host is not joined to a domain
  62. · WinRM session (historical): 5 records
  63. · Windows Backup operation (historical): 0 records
  64. · Remote Desktop Services record (historical): 0 records
  65. · Remote Desktop client connection (historical): 17 records
  66. · Group Policy extension run (historical): 0 records
  67. OK Scope: analysed in 7ms - 0 signal(s); 1 rules: 0 flagged, 0 clear, 1 not run
  68. WARN PowerShellCore/Operational log: stopped early after 6ms with 0 events read - EvtQuery(PowerShellCore/Operational): this event log does not exist on this host
  69. · local account (now): 7 records
  70. OK OpenSSH/Operational log: 0 events read in 2ms (0 a second)
  71. OK Microsoft-Windows-Backup log: 0 events read in 14ms (0 a second)
  72. OK Microsoft-Windows-TerminalServices-RDPClient/Operational log: 17 events read in 10ms (1,632 a second)
  73. · local administrator (now): 2 records
  74. OK Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log: 0 events read in 14ms (0 a second)
  75. WARN Group Policy setting (now): unavailable - this host is not joined to a domain
  76. · antivirus protection event (historical): 2 records
  77. OK Microsoft-Windows-AppLocker/MSI and Script log: 0 events read in 6ms (0 a second)
  78. OK Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log: 0 events read in 14ms (0 a second)
  79. · Scope: SCOPE-PIVOT-HIT not run - the run's profile gives no pivot points
  80. OK Microsoft-Windows-WinRM/Operational log: 5 events read in 5ms (1,097 a second)
  81. OK Microsoft-Windows-GroupPolicy/Operational log: 0 events read in 37ms (0 a second)
  82. · protection block (historical): 0 records
  83. WARN file in SYSVOL (now): unavailable - this host is not a domain controller
  84. · user profile (on disk): 6 records
  85. · WMI activity (historical): 1,336 records
  86. · Remote Desktop Services record (historical): 16 records
  87. INFO Remote Desktop Services record (historical): needs Remote Desktop connections allowed, which is off on this host
  88. OK Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log: 16 events read in 17ms (925 a second)
  89. OK Microsoft-Windows-Windows Firewall With Advanced Security/Firewall log: 2 events read in 59ms (33 a second)
  90. OK Microsoft-Windows-AppLocker/EXE and DLL log: 0 events read in 58ms (0 a second)
  91. OK group policy: 0 records read in 167ms
  92. · signed in (now): 1 records
  93. OK account records: 16 records read in 189ms
  94. · WMI subscription registered (historical): 0 records
  95. OK Microsoft-Windows-WMI-Activity/Operational log: 1,336 events read in 169ms (7,914 a second)
  96. · PowerShell script block (historical): 7 records
  97. · PowerShell engine start (historical): 158 records
  98. OK Windows PowerShell log: 165 events read in 143ms (1,153 a second)
  99. · BITS transfer job (historical): 799 records
  100. OK Microsoft-Windows-Bits-Client/Operational log: 799 events read in 249ms (3,203 a second)
  101. · recovery mechanism (now): 5 records
  102. OK recovery state: 5 records read in 327ms
  103. · application installed or removed (Windows Installer): 249 records
  104. · remote access tool's event (Windows event log): 16,376 records
  105. OK Application log: 16,376 events read in 331ms (49,495 a second)
  106. · shadow copies lost (volsnap, historical): 0 records
  107. · System log record: 1,121 records
  108. · service installation (historical): 94 records
  109. OK System log: 1,576 events read in 256ms (6,151 a second)
  110. · antivirus detection (historical): 115 records
  111. · antivirus protection event (historical): 2,231 records
  112. · protection block (historical): 0 records
  113. OK Microsoft-Windows-Windows Defender/Operational log: 2,346 events read in 280ms (8,371 a second)
  114. · PowerShell script block (historical): 1,445 records
  115. INFO PowerShell script block (historical): needs PowerShell module logging, which is off on this host
  116. OK Microsoft-Windows-PowerShell/Operational log: 1,445 events read in 326ms (4,438 a second)
  117. · scheduled task change (historical): 2,855 records
  118. OK Microsoft-Windows-TaskScheduler/Operational log: 2,855 events read in 355ms (8,047 a second)
  119. · installed application (now): 637 records
  120. OK installed applications: 637 records read in 374ms
  121. INFO Applications: running
  122. OK Applications: analysed in 4ms - 0 signal(s); 4 rules: 0 flagged, 4 clear, 0 not run
  123. · process creation (historical): 3,018 records
  124. · network connection (historical): 4,273 records
  125. · WMI subscription registered (historical): 0 records
  126. OK Microsoft-Windows-Sysmon/Operational log: 7,291 events read in 489ms (14,912 a second)
  127. · process creation (historical): 5,686 records
  128. · Security log record: 22,340 records
  129. · logon (historical): 588 records
  130. · failed logon (historical): 0 records
  131. · explicit credentials (historical): 23 records
  132. · administrative logon (historical): 567 records
  133. · Remote Desktop Services record (historical): 0 records
  134. · network connection (historical): 0 records
  135. INFO network connection (historical): needs Filtering Platform Connection auditing, which is off on this host
  136. · service installation (historical): 54 records
  137. · scheduled task change (historical): 541 records
  138. OK Security log: 22,340 events read in 704ms (31,743 a second)
  139. INFO LogIntegrity: running
  140. INFO Users: running
  141. INFO Logons: running
  142. OK Logons: analysed in 1ms - 0 signal(s); 11 rules: 0 flagged, 11 clear, 0 not run
  143. OK Users: analysed in 3ms - 1 signal(s); 11 rules: 1 flagged, 10 clear, 0 not run
  144. OK LogIntegrity: analysed in 39ms - 8 signal(s); 10 rules: 4 flagged, 6 clear, 0 not run
  145. · antivirus product (now): 1 records
  146. · Windows protection (now): 15 records
  147. · antivirus detection history (now): 4 records
  148. · antivirus status (now): 1 records
  149. · antivirus exclusion (now): 7 records
  150. OK antivirus state: 28 records read in 867ms
  151. · browser extension (now): 44 records
  152. · file downloaded (browser history, Mark of the Web): 79 records
  153. · site visited (browser history): 500 records
  154. OK browsers: 623 records read in 934ms
  155. · program run (historical): 2,317 records
  156. · PowerShell history (in a user's history file now): 3,469 records
  157. · PowerShell transcript (in a transcript file now): 0 records
  158. INFO PowerShell transcript (in a transcript file now): needs PowerShell transcription, which is off on this host
  159. OK program runs: 5,786 records read in 1.05s
  160. INFO Directory: running
  161. OK Directory: analysed in <1ms - 0 signal(s); 25 rules: 0 flagged, 1 clear, 24 not run
  162. · Directory: DIR-RC4-SERVICE-TICKETS not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  163. · Directory: DIR-TICKETS-WITHOUT-PREAUTH not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  164. · Directory: DIR-PASSWORD-SPRAY not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  165. · Directory: DIR-PASSWORD-GUESSING not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  166. · Directory: DIR-GPO-IMMEDIATE-TASK not run - this host is not joined to a domain
  167. · Directory: DIR-GPO-TASK-FROM-SHARE not run - this host is not joined to a domain
  168. · Directory: DIR-GPO-RUNS-FROM-USER-FOLDER not run - this host is not joined to a domain
  169. · Directory: DIR-GPO-COMMAND-WITH-URL not run - this host is not joined to a domain
  170. · Directory: DIR-GPO-COPIES-EXECUTABLE not run - this host is not joined to a domain
  171. · Directory: DIR-GPO-DEFENDER-POLICY-OFF not run - this host is not joined to a domain
  172. · Directory: DIR-GPO-DEFENDER-EXCLUSION not run - this host is not joined to a domain
  173. · Directory: DIR-GPO-RECOVERY-SERVICE-OFF not run - this host is not joined to a domain
  174. · Directory: DIR-GPO-LOCAL-ADMIN-MEMBER not run - this host is not joined to a domain
  175. · Directory: DIR-GPO-STORED-PASSWORD not run - this host is not joined to a domain
  176. · Directory: DIR-GPO-DEPLOYS-CODE-IN-PERIOD not run - no period was given (the profile's window)
  177. · Directory: DIR-GPO-CREATED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  178. · Directory: DIR-GPO-LINKED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  179. · Directory: DIR-SYSVOL-FILE-IN-PERIOD not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  180. · Directory: DIR-SYSVOL-DISGUISED-EXECUTABLE not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  181. · Directory: DIR-PRIVILEGED-GROUP-MEMBER-ADDED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  182. · Directory: DIR-SENSITIVE-GROUP-MEMBER-ADDED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  183. · Directory: DIR-DELEGATION-SET not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  184. · Directory: DIR-ADMINSDHOLDER-CHANGED not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  185. · Directory: DIR-REPLICATION-BY-NON-COMPUTER not run - not a domain controller (this host is not joined to a domain): only a domain controller records this
  186. WARN web site (configured now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  187. WARN server-side script (in a web site's folders now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  188. WARN web server module or handler (configured now): unavailable - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  189. OK web servers: 0 records read in 1.15s
  190. · remote access tool (installed, run or its files): 2 records
  191. · remote access session (the tool's log): 8 records
  192. · file transfer (the remote access tool's log): 1 records
  193. · Windows remote access setting (now): 2 records
  194. OK remote access tools: 13 records read in 1.46s
  195. · running process (now): 553 records
  196. OK process table: 553 records read in 1.68s
  197. INFO Executions: running
  198. INFO Webshells: running
  199. OK Webshells: analysed in <1ms - 0 signal(s); 6 rules: 0 flagged, 1 clear, 5 not run
  200. · Webshells: WEB-WEBSHELL-HIGH not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  201. · Webshells: WEB-WEBSHELL-MEDIUM not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  202. · Webshells: WEB-WEBSHELL-LOW not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  203. · Webshells: WEB-NATIVE-MODULE-UNUSUAL not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  204. · Webshells: WEB-HANDLER-ON-STATIC-TYPE not run - no web site is configured on this host (IIS, Apache httpd, nginx, Tomcat)
  205. OK Executions: analysed in 101ms - 3 signal(s); 29 rules: 3 flagged, 26 clear, 0 not run
  206. · network connection or listener (now): 646 records
  207. WARN connection in the firewall's log (historical): unavailable - no firewall log file exists
  208. INFO connection in the firewall's log (historical): needs Windows Firewall logging of allowed connections, which is off on this host
  209. · network setting (now): 1 records
  210. · network adapter (now): 11 records
  211. OK network: 658 records read in 1.91s
  212. INFO Network: running
  213. OK Network: analysed in <1ms - 0 signal(s); 12 rules: 0 flagged, 12 clear, 0 not run
  214. · configured service (now): 779 records
  215. OK service table: 779 records read in 2.79s
  216. INFO Backup: running
  217. OK Backup: analysed in <1ms - 0 signal(s); 7 rules: 0 flagged, 7 clear, 0 not run
  218. · auto-start entry (now): 95 records
  219. · scheduled task (now): 277 records
  220. · WMI subscription (now): 1 records
  221. OK persistence: 373 records read in 3.83s
  222. INFO Protection: running
  223. INFO Browsers: running
  224. INFO Persistence: running
  225. INFO RemoteAccess: running
  226. OK Protection: analysed in 3ms - 17 signal(s); 25 rules: 12 flagged, 13 clear, 0 not run
  227. OK Persistence: analysed in 7ms - 4 signal(s); 31 rules: 4 flagged, 27 clear, 0 not run
  228. OK RemoteAccess: analysed in 54ms - 7 signal(s); 23 rules: 5 flagged, 16 clear, 2 not run
  229. · RemoteAccess: RA-INSTALLED-IN-PERIOD not run - no period was given (the profile's window)
  230. · RemoteAccess: RA-NOT-ALLOWED not run - no approved list was given (the profile's modules.RemoteAccess.approved_tools): authorization is unknown
  231. OK Browsers: analysed in 168ms - 15 signal(s); 16 rules: 8 flagged, 7 clear, 1 not run
  232. · Browsers: BROWSER-DOWNLOAD-IN-PERIOD not run - no period was given (the profile's window)
  233. OK survey finished in 4.51s - 14 module(s); signals: 18 high · 26 medium · 11 low
  234. OK wrote host.json (1,496 KB)
Run times and requirements

Where to Look & What You Can't See

50+ Windows artifacts and data sources, each read once - and a health report for every one of them.

Event logs

Security, System, PowerShell, Sysmon, Remote Desktop, Defender, Task Scheduler, BITS, WMI, WinRM, Group Policy and more.

  • 4624 logons
  • 4688 process starts
  • 7045 services
  • 4104 script blocks
  • 1102 log cleared

Registry and files

Auto-starts of every user, scheduled tasks, Prefetch, BAM, PowerShell history, installed software, browser profiles, web roots.

  • Run keys
  • TaskCache
  • Prefetch
  • Mark of the Web
  • Uninstall keys

Live memory state

Read through Windows' own interfaces: processes, services, accounts, network tables, WMI and the audit policy.

  • Process table
  • Services
  • TCP/IP tables
  • Defender status
  • Audit policy

Enrichment

For every program a signal names: whether it is still on disk, its hashes, signature and signer, and its version details.

  • Still on disk?
  • SHA-256
  • SHA-1
  • MD5
  • Signer
  • Original name
What you can't see

Every source reports its health

  • Read
  • Partly read
  • Not read, and why
  • Unavailable on this host

Auditing that was off, logs cleared or too small to reach back.

Every source Signal reads Telemetry: what Signal could not see

How It Works

One small executable on the host, one console for the fleet.

  1. 01

    Run Signal on the host

    From an elevated prompt, or as SYSTEM from your deployment tool. Nothing to install; a profile can scope the run to an incident.

    signal live -all -o C:\runs\
  2. 02

    Send it to Signal Console

    Push each run as it finishes, or import the files. A run that cannot be sent waits in an outbox, so none is lost.

  3. 03

    Triage across the fleet

    One case per investigation. Mark each entity reviewed, benign or escalated, follow it on the timeline and graph, and export the compromise assessment report.

Every host of a case, its worst signal and its blind spots.
A tour of Signal Console

Modules

Each module answers one question a responder asks about a host, from every source that records it.

14
modules
200+
built-in rules
critical, high, medium, low
MITRE
ATT&CK tagged
Executions

What ran on the host, and how was it abused?
Persistence

What will run again without anyone starting it?
Logons

How was the host used, and from where?
Users

Who used the host?
LogIntegrity

Can the host's logs be trusted?
Protection

What protects the host from malware, and does it work?
Network

What does the host listen on and talk to?
RemoteAccess

Which remote access tools can reach and control the host?
Browsers

What came in through a browser?
Webshells

Which sites does the host serve, and do they hold a webshell?
Applications

What software is installed?
Backup

Can the host be recovered, and did someone take that away?
Directory

What did the domain push to this host through Group Policy?
Scope

Does this host hold any of the incident's pivot points?

Need a check of your own? Write it.

A rule is a small JSON file with its own tests, and it matches against every piece of evidence Signal reads - the same fields the built-in rules use. Share it in the community rule library.

Your first rule Open the rule library

Where It Fits

Not a replacement for your EDR, SIEM or antivirus: it asks what the host itself says, right now.

The telemetry Signal reads, and where it finds
On the host
  • Event logs, back as far as Windows kept them
  • Registry and configuration
  • File and program metadata
  • Live state: processes, services, connections
signal.exe
  • Reads each source once
  • Applies 200+ rules
  • Names what it could not read
Signal Console
  • Stacks persistence across hosts, rarest first
  • One graph of programs, accounts and addresses
  • Flags KEV-listed apps and VirusTotal answers
  • A fleet timeline to triage
EDR
its own sensor's events, from the day it was installed.
SIEM
the logs someone chose to forward.
Antivirus
file and process content, against known threats.
Collectors
raw artifacts copied off; finding is left to an analyst.
Signal
what the host itself recorded, found on the host and again across the fleet - with or without an agent, forwarding or a copy.

When to run it

  1. Rapid triage & responseat the start of an incident, when the alert arrives.
  2. Scopingon every host, with the incident's pivot points in a profile.
  3. Threat huntsweep the fleet for the same pivot points or a new rule.
  4. Compromise assessmentacross a fleet, to find the hosts worth a deeper look.
  5. After cleanupcheck that persistence and remote access are gone.
Across the enterprise

Runs from the tools you already deploy with

One file under 10 MB: quick to copy to thousands of hosts at once, over a slow link or a busy network.

As SYSTEM, with no credentials left on the host. Runs land on a write-only share or are pushed to Signal Console through the host's own proxy and certificate store; a busy console queues pushes and a host keeps its run in an outbox until it is accepted.

Running at scale

What It Is Not

Knowing a tool's limits is part of using it well.

Not a replacement for DFIR analysis: it tells you where to start.

  • Not an EDR: it runs once, it does not watch or block.
  • Not a collector or acquisition tool: it takes no disk, triage or memory image and gathers no raw artifacts.
  • Not a YARA scanner: it does not scan file content for signatures.
  • Not a memory scanner: it does not inspect processes or objects in memory.
  • Not a log parser: it does not turn raw logs into a full event timeline or forensic report.
Everything Signal does not read
Enterprise threat detection & response ecosystem Each tool adds its part; Signal is one of them.
  • Watch and respond, all the timeEDR
  • Stop known malware as it landsAntivirus
  • Copy the evidence off the hostCollector or imaging tool
  • Match file content against signaturesYARA scanner
  • Inspect what is in memoryMemory forensics
  • Rebuild the full event timelineLog parser or forensic suite
  • Rapid triage at scale: where to look, and the telemetry and audit gapsSignal

Documentation

From your first run to writing your own rules, versioned with every release.

Signal Documentation
  1. Start here
  2. Getting started
  3. Core concepts
  4. Modules
  5. Using Signal
  6. Signal Console
  7. Writing rules
  8. Limits and gaps
  9. Reference
Open the documentation

Ready for Enterprise Review

Engineered for enterprise from the first line, and documented for your security, privacy, legal and procurement reviewers.

Compliance

Built to pass your review

  • Mapped against NIST, CIS, SLSA and ISO/IEC 27001, control by control
  • Every claim backed by evidence your auditors can check
Security testing

Attacked before it shipped

  • Penetration-tested end to end: the program and the console
  • Every parser hardened against data an intruder planted
Code review

Nothing merges unreviewed

  • Each change reviewed, each defect traced to its root cause
  • Dependencies scanned for known vulnerabilities on every build
Footprint

Reads, never writes

  • One file under 10 MB: installs nothing, changes nothing, leaves only what Windows itself records
  • Every trace a run leaves is documented, so your change board knows it in advance
Least privilege

Admin rights, used narrowly

  • Takes only the access the evidence requires - nothing more
  • Loads system code from trusted locations only
Data handling

Your data stays yours

  • Nothing is sent to us: no telemetry, no licence call, no cloud
  • Collects findings, not personal files, passwords or memory
Scale

Sized for the whole fleet

  • Thousands of hosts in a single case, on modest hardware
  • Results queue safely when the network or the console is busy
Supply chain

Verifiable from source to binary

  • Reproducible builds you can rebuild and compare yourself
  • A bill of materials, build provenance and a code signature with every release

Get Started

One file under 10 MB, nothing to install. Free to defend what you own; licensed when you serve others.

  1. Defending your own organisation? Community
  2. Need more features and operating systems? Pro Coming soon
  3. Serving clients? Enterprise / Consultant

Community

Free

Defend the computers and networks you or your organisation own or operate.

v1.0.1 Latest version. When a new one comes out, request it here again: same form, same quick steps.

Read your runs in Signal Console, free on GitHub.

  • signal.exe live mode, every module
  • Signal Console: manual import, one data set
  • Your own incident response, threat hunting and compromise assessment
  • Personal, educational and research use
Request Signal v1.0.1

Enterprise / Consultant

Commercial

For firms and consultants who serve clients.

Everything in Community, plus:

  • Use for services to clients: DFIR, compromise and gap assessments
  • Each host sends its results straight to Signal Console, filed into cases - no copying files by hand
  • Exclusive modules, only in this edition, that widen what Signal reads and checks
  • New rules from our continuous threat intelligence, covering emerging threats as they appear
  • Engagement support: our team beside yours in incident response, compromise assessments and threat hunts
  • Training sessions for your SOC, DFIR and threat hunting teams
Talk to us about Enterprise

Signal Community License 1.0.0. Community is free solely to defend the systems you or your organisation own or operate. Services to clients (paid or not), resale, redistribution outside your organisation, or building Signal into another product need the Enterprise / Consultant edition.

Contact Us

Signal gets better with every responder who uses it. Tell us what you found.

Suggest a feature Report a bug Report a vulnerability Talk to us
This is only the start. See what comes next for Signal

What Comes Next

Signal keeps reaching further: wider, then deeper.

  1. 01

    More modules, more sources

    New modules that read what Signal leaves untouched today.

    • Amcache
    • Shimcache
    • $MFT & USN journal
    • LNK & jump lists
    • Shellbags
    • Defender logs & quarantine
    • DNS & ARP cache
  2. 02

    Forensics offline mode

    Run Signal against a disk image instead of a live host.

  3. 03

    Linux edition

    The same first minute on Linux servers and workstations.

  4. 04

    macOS edition

    The same first minute on Macs.

  5. 05

    The dark places: memory

    Where code that never touches disk lives.

    • User space
    • Kernel space
  6. …

    And much more

    Still in planning, and already in the works.