ZDI-26-971: Signal for Windows Remote Code Execution — Detection, Hunting, and Mitigation Guide

---
title: Signal Desktop Spawning Suspicious Child Process
id: 8f3a2b1c-4d5e-4f6a-9b8c-7d2e1f3a4b5c
status: experimental
description: Detects Signal Desktop (Signal.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe — a strong indicator of successful exploitation of ZDI-26-971 or attachment-based code execution.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-971/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Signal.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\schtasks.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Signal updates or plugin execution (rare — validate with software inventory)
  - Enterprise software deployment tools running in user context
level: high
---
title: Execution from Signal Attachments Directory
id: 2b4c6d8e-1f3a-4b5c-9d7e-6a8f2b4c6d8e
status: experimental
description: Detects process execution from Signal Desktop's default attachments/download directories. Attackers exploiting ZDI-26-971 will likely drop and execute payloads from these paths after the victim accepts a malicious attachment.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-971/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|contains:
      - '\AppData\Roaming\Signal\attachments\'
      - '\AppData\Roaming\Signal\downloads\'
      - '\Downloads\Signal\'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
      - '.js'
      - '.hta'
      - '.scr'
      - '.msi'
  condition: selection_paths and selection_ext
falsepositives:
  - Legitimate user-saved files executed intentionally (tune with file hash reputation and user baseline)
level: high
---
title: Signal Desktop Process Making Unusual Network Connections
id: 5e7f9a1b-3c5d-4e6f-8a9b-2c4d6e8f1a3b
status: experimental
description: Detects Signal.exe establishing network connections to non-Signal infrastructure or unusual ports, potentially indicating post-exploitation C2 activity following successful ZDI-26-971 exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-971/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith: '\Signal.exe'
  selection_ports:
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 7777
      - 8888
      - 9999
      - 1337
      - 31337
  filter_signal_domains:
    DestinationHostname|contains:
      - 'signal.org'
      - 'whispersystems.org'
      - 'signalusers.org'
  condition: selection_image and selection_ports and not filter_signal_domains
falsepositives:
  - Signal beta builds or development environments connecting to test infrastructure
  - Corporate proxies intercepting Signal traffic (validate DestinationHostname is not proxy)
level: medium

// Hunt for Signal.exe spawning suspicious child processes — potential ZDI-26-971 exploitation
let SuspiciousChildren = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "schtasks.exe", "msiexec.exe", "whoami.exe", "net.exe", "nltest.exe"
]);
let SignalPaths = dynamic([
    @"\AppData\Roaming\Signal\attachments\",
    @"\AppData\Roaming\Signal\downloads\",
    @"\Downloads\Signal\"
]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "Signal.exe"
| where FileName in~ (SuspiciousChildren)
    or ProcessCommandLine has_any (SignalPaths)
| extend Suspicious = true
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "Signal.exe"
    | where RemotePort in (4444, 5555, 6666, 7777, 8888, 9999, 1337, 31337)
    | where not(RemoteUrl has_any ("signal.org", "whispersystems.org"))
    | summarize NetworkHits = make_set(strcat(RemoteIP, ":", RemotePort)) by DeviceId, InitiatingProcessId
) on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessId, NetworkHits, SHA256, FolderPath
| extend Severity = case(
    NetworkHits != "", "Critical — Signal spawned shell + suspicious network",
    ProcessCommandLine has_any (SignalPaths), "High — Execution from Signal attachment dir",
    "High — Signal spawned suspicious child"
)
| order by TimeGenerated desc

-- Hunt: Signal Desktop Exploitation Artifacts (ZDI-26-971)
-- Author: Security Arsenal DFIR
-- Purpose: Identify Signal.exe spawning suspicious children, files in attachment dirs, and anomalous network connections

LET SignalProcesses =
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'Signal.exe'
   OR Exe =~ 'Signal\\Signal.exe'

LET SuspiciousChildren =
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       SignalPid = SignalProcesses.Pid,
       SignalUser = SignalProcesses.Username
FROM pslist()
JOIN SignalProcesses ON pslist.Ppid = SignalProcesses.Pid
WHERE Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|schtasks|msiexec)\.exe$'

LET AttachmentArtifacts =
SELECT FullPath, Size, Mtime, Ctime, IsDir
FROM glob(globs='C:/Users/*/AppData/Roaming/Signal/attachments/**/*')
WHERE NOT IsDir
  AND FullPath =~ '\.(exe|dll|bat|cmd|ps1|vbs|js|hta|scr|msi)$'
  AND Mtime > now() - 604800  // Last 7 days

LET NetworkAnomalies =
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ 'Signal.exe'
  AND RemotePort IN (4444, 5555, 6666, 7777, 8888, 9999, 1337, 31337)
  AND NOT RemoteAddr =~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'

SELECT
    'SuspiciousChild' AS FindingType,
    SuspiciousChildren.Pid AS Pid,
    SuspiciousChildren.Name AS ProcessName,
    SuspiciousChildren.Exe AS Executable,
    SuspiciousChildren.CommandLine AS CommandLine,
    SuspiciousChildren.Username AS Username,
    SuspiciousChildren.CreateTime AS EventTime
FROM SuspiciousChildren

UNION ALL

SELECT
    'AttachmentArtifact' AS FindingType,
    NULL AS Pid,
    FullPath AS ProcessName,
    NULL AS Executable,
    NULL AS CommandLine,
    NULL AS Username,
    Mtime AS EventTime
FROM AttachmentArtifacts

UNION ALL

SELECT
    'NetworkAnomaly' AS FindingType,
    Pid,
    Name AS ProcessName,
    NULL AS Executable,
    strcat(LocalAddr, ':', LocalPort, ' -> ', RemoteAddr, ':', RemotePort) AS CommandLine,
    NULL AS Username,
    NULL AS EventTime
FROM NetworkAnomalies

ORDER BY EventTime DESC

#Requires -RunAsAdministrator
# ZDI-26-971 Signal for Windows RCE — Audit & Hardening Script
# Security Arsenal — vulnerability-management

$ErrorActionPreference = 'Continue'
$LogPath = "$env:ProgramData\SecurityArsenal\ZDI-26-971_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
New-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $Entry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') [$Level] $Message"
    Add-Content -Path $LogPath -Value $Entry
    Write-Host $Entry
}

Write-Log "=== ZDI-26-971 Signal RCE Audit & Hardening ==="

# 1. Detect installed Signal versions
$SignalPaths = @(
    "$env:LOCALAPPDATA\Programs\signal-desktop\Signal.exe",
    "$env:ProgramFiles\Signal\Signal.exe",
    "$env:ProgramFiles(x86)\Signal\Signal.exe"
)

$SignalFound = $false
foreach ($Path in $SignalPaths) {
    if (Test-Path $Path) {
        $SignalFound = $true
        $Version = (Get-Item $Path).VersionInfo.ProductVersion
        Write-Log "Signal found: $Path | Version: $Version"
        # TODO: Update with patched version once Signal releases fix
        # if ([version]$Version -lt [version]'X.Y.Z') { Write-Log "VULNERABLE" 'WARN' }
    }
}
if (-not $SignalFound) { Write-Log "Signal Desktop not detected on this host." }

# 2. Audit recent execution from Signal attachment directories
$SignalDirs = @(
    "$env:APPDATA\Signal\attachments",
    "$env:APPDATA\Signal\downloads",
    "$env:USERPROFILE\Downloads\Signal"
)

foreach ($Dir in $SignalDirs) {
    if (Test-Path $Dir) {
        $RecentFiles = Get-ChildItem -Path $Dir -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            Where-Object { $_.Extension -match '\.(exe|dll|bat|cmd|ps1|vbs|js|hta|scr|msi)$' }
        if ($RecentFiles) {
            Write-Log "Potentially malicious files in $Dir :" 'WARN'
            $RecentFiles | ForEach-Object { Write-Log "  - $($_.FullName) | $($_.LastWriteTime)" 'WARN' }
        }
    }
}

# 3. Check for suspicious Signal child processes (last 24h)
$SuspiciousProcs = Get-CimInstance Win32_Process |
    Where-Object { $_.ParentProcessId -in (Get-CimInstance Win32_Process |
        Where-Object { $_.Name -eq 'Signal.exe' }).ProcessId } |
    Where-Object { $_.Name -match 'cmd|powershell|wscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic|schtasks' }

if ($SuspiciousProcs) {
    Write-Log "ALERT: Signal.exe has suspicious child processes running NOW:" 'CRITICAL'
    $SuspiciousProcs | ForEach-Object { Write-Log "  - $($_.Name) | PID: $($_.ProcessId) | $($_.CommandLine)" 'CRITICAL' }
}

# 4. Apply Attack Surface Reduction (ASR) rule to block Office child processes (compensating control)
# Note: Enable only if Signal is used in a managed enterprise context where users do not need to open attachments directly
Write-Log "Applying Windows Defender ASR rules as compensating controls..."
$ASRRules = @(
    @{ Id = 'D4F940AB-401B-4EFC-AADC-AD5F3C50688A'; Name = 'Block all Office applications from creating child processes' },
    @{ Id = '26190899-1602-49E8-8B27-EB1D0A1CE869'; Name = 'Block Office communication applications from creating child processes' },
    @{ Id = '3B576869-A4EC-4529-8536-B80A7769E899'; Name = 'Block Office applications from creating executable content' },
    @{ Id = '7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C'; Name = 'Block Adobe Reader from creating child processes' }
)

foreach ($Rule in $ASRRules) {
    try {
        Set-MpPreference -AttackSurfaceReductionRules_Ids $Rule.Id -AttackSurfaceReductionRules_Actions Enabled
        Write-Log "Enabled ASR: $($Rule.Name)"
    } catch {
        Write-Log "Failed to enable ASR $($Rule.Id): $_" 'ERROR'
    }
}

# 5. Enforce SmartScreen for downloaded files (additional UI warning layer)
Write-Log "Configuring Windows SmartScreen and Mark-of-the-Web (MotW) enforcement..."
Set-MpPreference -EnableSmartScreen $true
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'EnableSmartScreen' -Value 1 -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name 'ShellSmartScreenLevel' -Value 'Block' -Force

# 6. Block execution from Signal attachment directories via AppLocker (if AppLocker is deployed)
$AppLockerTest = Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue
if ($AppLockerTest) {
    Write-Log "AppLocker detected. Recommend adding deny rules for:"
    Write-Log "  - %APPDATA%\Signal\attachments\*\*.exe"
    Write-Log "  - %APPDATA%\Signal\downloads\*\*.exe"
    Write-Log "  - %USERPROFILE%\Downloads\Signal\*\*.exe"
} else {
    Write-Log "AppLocker not configured. Consider Software Restriction Policies (SRP) or WDAC as alternative."
}

# 7. Force Signal update check (if auto-update disabled)
$SignalUpdateUrl = 'https://updates.signal.org/desktop/latest.yml'
Write-Log "Manual update check: Instruct users to open Signal > Help > Check for Updates"
Write-Log "Or download latest from: https://signal.org/download/"

Write-Log "=== Audit complete. Log saved to $LogPath ==="
Write-Log "Next steps: Deploy vendor patch immediately upon release. Monitor CISA KEV for ZDI-26-971."