What Signal reads
On this page
Every source Signal 1.0 reads, by where Windows keeps it - and which module uses it.
Event logs
Log | Events | Used by |
|---|---|---|
Security | Logons (4624, 4625, 4648, 4672), process creation (4688) and exit (4689), account and group changes, audit policy changes (4719), log cleared (1102), service installation (4697), task changes (4698-4702), time changed (4616), connections (5156), RDP reconnects (4778, 4779), directory changes and access on a domain controller (5136-5141, 4662), Kerberos and NTLM on a domain controller (4768, 4769, 4771, 4776) | Logons, Users, Executions, Persistence, LogIntegrity, Network, Directory |
System | Service installed (7045), log cleared (104), shutdowns (6005, 6006, 6008), volsnap (25, 36) | Persistence, LogIntegrity, Backup |
PowerShell, Windows PowerShell | Script blocks (4104), module logging (4103, 800), engine starts (400) | Executions |
Sysmon (when installed) | Process creation (1), connections (3), WMI subscriptions (19-21) | Executions, Network, Persistence |
Remote Desktop logs | LocalSessionManager, RemoteConnectionManager, RdpCoreTS, RDPClient | Logons |
Defender Operational, code integrity, AppLocker, firewall | Detections, protection changes, blocks, firewall rules deleted | Protection |
TaskScheduler, Bits-Client, WMI-Activity, WinRM | Task changes, BITS jobs, WMI activity, WinRM sessions | Persistence, Executions |
Application, OpenSSH | Windows Installer (1033, 1034), remote access tools' events | Applications, RemoteAccess |
GroupPolicy, Windows Backup | Extension runs, backup operations | LogIntegrity, Backup |
Registry and files
Source | Used by |
|---|---|
Auto-start locations of the machine and every user (signed-out users' hives parsed from disk) | Persistence |
Scheduled tasks: TaskCache, task XML and | Persistence |
Prefetch, BAM, DAM, the PCA launch list | Executions |
PowerShell history files and transcripts of every profile | Executions |
Uninstall keys, Windows Installer, Store packages | Applications |
Browser profiles: extensions, history databases, the Mark of the Web in Downloads and Desktop | Browsers |
Web server configuration and site folders (stat only) | Webshells |
Remote access tools' folders, configuration and logs | RemoteAccess |
Group Policy's records and copies; SYSVOL on a domain controller | Directory, LogIntegrity |
Hosts file, proxies, the firewall's log files | Network |
Recovery settings: ReAgent.xml, boot configuration, System Restore and File History policy | Backup |
Live state, through Windows' own interfaces
Source | Used by |
|---|---|
The process table (limited query) | Executions, and every module that joins to it |
The Service Control Manager | Persistence, Backup |
The local account database, the Administrators group, sessions | Users |
The TCP/IP tables, network adapters, shares | Network |
WMI: Security Center, Defender, shadow copies, subscriptions, Device Guard, BitLocker | Protection, Backup, Persistence |
The audit policy | LogIntegrity and every module's telemetry |
Enrichment
For every program and file a signal names: whether it is on disk, its size and times, SHA-256, SHA-1 and MD5 (in one read), its signature and signer (offline), and its version resource - original name, description, company, product.
Browsers covered
Every Chromium-based browser - Edge, Chrome, Opera, Brave, Vivaldi, Chromium, Yandex, and other Chromium builds found in a user's AppData - and every Gecko-based browser: Firefox, Waterfox, LibreWolf.
Web servers covered
IIS (with Exchange and SharePoint recognised), Apache httpd, nginx and Tomcat.