Field reference
Every kind of evidence Signal sees, and every field of each one: what you can match in a rule, and what each value means.
How to use this reference
Evidence types are the kinds of record a rule reads. A rule names them in
evidence.Fields are what a rule matches in
detection. A rule may only use fields its evidence types carry - the check refuses any other.An event type is something that happened at a time (a log record). A state type is something true when Signal read the host (a running process, a configured service).
A derived field is computed by Signal - for example a source address's scope from the address. It is never something to wait for Windows to write.
A field only recorded when a policy is on is unknown, not empty, when the policy is off.
Values worth knowing
Field | Values |
|---|---|
|
|
|
|
|
|
|
|
|
|
Booleans | Matched as |
Every evidence type
Evidence type | What it is | Fields |
|---|---|---|
process creation (historical) | 14 | |
running process (now) | 12 | |
program run (historical) | 4 | |
PowerShell script block (historical) | 9 | |
PowerShell engine start (historical) | 3 | |
PowerShell history (in a user's history file now) | 7 | |
PowerShell transcript (in a transcript file now) | 6 | |
WMI activity (historical) | 14 | |
WMI subscription (now) | 5 | |
WMI subscription registered (historical) | 5 | |
WinRM session (historical) | 6 | |
logon (historical) | 14 | |
failed logon (historical) | 15 | |
explicit credentials (historical) | 10 | |
administrative logon (historical) | 6 | |
Remote Desktop Services record (historical) | 9 | |
Remote Desktop client connection (historical) | 4 | |
local account (now) | 15 | |
local administrator (now) | 5 | |
user profile (on disk) | 8 | |
signed in (now) | 11 | |
Security log record | 20 | |
System log record | 11 | |
service installation (historical) | 11 | |
configured service (now) | 16 | |
scheduled task (now) | 15 | |
scheduled task change (historical) | 10 | |
auto-start entry (now) | 12 | |
BITS transfer job (historical) | 10 | |
antivirus product (now) | 4 | |
antivirus status (now) | 16 | |
antivirus exclusion (now) | 3 | |
antivirus detection (historical) | 16 | |
antivirus detection history (now) | 13 | |
antivirus protection event (historical) | 14 | |
protection block (historical) | 9 | |
Windows protection (now) | 4 | |
network connection or listener (now) | 17 | |
network connection (historical) | 10 | |
connection in the firewall's log (historical) | 8 | |
network setting (now) | 5 | |
network adapter (now) | 10 | |
remote access tool (installed, run or its files) | 38 | |
remote access session (the tool's log) | 15 | |
file transfer (the remote access tool's log) | 9 | |
Windows remote access setting (now) | 6 | |
remote access tool's event (Windows event log) | 3 | |
browser extension (now) | 19 | |
file downloaded (browser history, Mark of the Web) | 35 | |
site visited (browser history) | 14 | |
web site (configured now) | 16 | |
server-side script (in a web site's folders now) | 11 | |
web server module or handler (configured now) | 11 | |
installed application (now) | 9 | |
application installed or removed (Windows Installer) | 8 | |
recovery mechanism (now) | 12 | |
Windows Backup operation (historical) | 3 | |
shadow copies lost (volsnap, historical) | 3 | |
Group Policy object (now) | 13 | |
Group Policy setting (now) | 19 | |
file in SYSVOL (now) | 6 | |
Group Policy extension run (historical) | 4 | |
directory change (historical) | 12 | |
directory operation (historical) | 9 | |
domain authentication (historical) | 11 | |
pivot point checked directly (now) | 2 |