messaging_signal

Explanation

The messaging_signal NDM is designed to detect the presence of the Signal messaging application on the network. Signal is an end to end encrypted messaging application that can be used for legitimate or malicious purposes.

What to Look For

To examine the results of this NDM Event, check for any outgoing or incoming Signal traffic on the network. This can be done by analyzing network traffic logs or using network monitoring tools. Additionally, it is recommended to check all endpoints for the presence of Signal installed or running in the background. If Signal is detected on a corporate endpoint, it is important to investigate further to ensure its usage is legitimate.