Your first run 1.0

Your first run

Last updated 10 Nov 2026
On this page

Run every module on one host and save the result to a file - the whole first run in four steps.

Run it

  1. Open an elevated prompt

    Right-click Terminal or PowerShell and choose Run as administrator.

  2. Go to Signal's folder

    cd C:\Tools\Signal (or wherever you put signal.exe).

  3. Run every module

    .\signal.exe live -all -o .\ - every module runs, and the run is saved in this folder as <host>-<run id>.json.

  4. Read the summary

    Signal prints a summary on the screen: how many signals of each severity, and any warnings. The details are in the file.

PowerShell Every module, saved here 
.\signal.exe live -all -o .\

Typing signal alone prints a short start screen with these same two commands.

Common variations

PowerShell See every step while it runs 
.\signal.exe live -all -o .\ -v
PowerShell Only some modules 
.\signal.exe live -m Executions,Persistence,LogIntegrity -o .\
PowerShell Send the run to Signal Console instead of a file 
.\signal.exe live -all -push https://signal-console:7446 -push-key-file key.txt
PowerShell List the modules and what each one answers 
.\signal.exe list

What happened on the host

Signal read the host and wrote one file. It installed nothing and changed nothing. Windows itself recorded that signal.exe started (a process creation event and, on client editions, a Prefetch file). Signal leaves events written after its own start out of its statistics and lists them as its own footprint. See What a run leaves on a host.

Next

Read your first run.