Probes now find files that no installer registered

Windows agents from version 0.3.119 list the executables where software is installed, once a day, and threat probes now search that list as well as the installed-software inventory.

On 21 October we wrote that a probe can miss a PHP that answers on a port. On Windows, PHP ships as a zip, and its engine, php8ts.dll, registers nowhere, so no package list could name it. A probe can now name the file itself, and the server matches it against each machine's last list. A machine that's switched off is found too.

To test it, we unzipped PHP 8.3.25 to C:\php on a test server, deployed a Tomcat application whose WAR carries log4j-core-2.14.1.jar, and shut the server down. Two probes found both from our side, each marked older than its fix.

Customers' agents follow our own fleet once it has run a release for a day without a halt. Ours moved to 0.3.120 the same afternoon, so Windows machines on automatic updates reach it from 25 October and send their first list the same day.

Where you'll see it

On a device page, Inventory > Executables shows how many executables the last audit listed, what arrived and what went in the last seven days, and the executables outside the program folders that carry no signature of their own. Windows signs some of its own files in a separate catalog, so a line in that list is a question to ask.

Stack > Find a file searches every client at once. Type php8ts.dll, or log4j-core* for every version, and you get each machine that has it, with the version, the product, who signed it, and when it was first seen and last confirmed. It also reads the names of the libraries packed inside Java archives.

A probe card says where each machine's copy was found, path included.

What the agent reads

It reads the program folders, ProgramData, the top-level folders of the system drive, each profile's AppData, and the folders that services, uninstall entries, startup entries, scheduled tasks and running processes point to. For each executable it keeps the name, version, product, company, the signer the file carries, size and path, and a SHA-256 within a daily budget.

It runs at background priority under a memory ceiling, waits up to 12 hours while a laptop is on battery, and sends its list only when the list changed. It doesn't open cloud placeholders such as OneDrive's files on demand, because opening one downloads it. On our test server a repeat run took 120 milliseconds for 677 executables. A machine's first run reads each file once and takes longer.

The server keeps the history and works out what changed. A file counts as gone when the folder it lived in was walked to the end, or when the folder itself is gone. A walk cut short by its time limit or by a folder it couldn't read leaves those files as they were, and the device page lists the folders it didn't finish.

What it doesn't do

It's Windows only for now. Linux and macOS are on the roadmap.

"Signed by" is the signer the file carries, read without checking the certificate chain. The audit lists files and doesn't look inside them for malware; the scanner does that.