Microsoft Windows

Manual Installation

Locate the Windows MSI installer file that you previously downloaded and simply double-click, a small progress window will appear which does not require any interaction.

Additional commands are available using the command line as outlined below. All commands can be used in combination as required.

Proxy Support

If your organization leverages a proxy then use the following command during install:

Example:

msiexec.exe /i "spiral-windows-amd64.msi" PROXY=http://<ip>:<port>

This will create a key in the Windows registry: ‘Computer\HKEY_LOCAL_MACHINE\SOFTWARE\NTT\Spiral’ with a parameter ‘Proxy’ with the proxy from the command line.

This can be added/changed/removed at a later time, if so the SamurAI Agent services must be restarted.

Quiet Mode Installation

Use the the following command for ‘quiet mode’ installation (i.e no progress window is displayed):

msiexec.exe /i "spiral-windows-amd64.msi" /qn

Verbose Installation Logs

If you wish to view installation logs you can use the following command to save logs to a file for review:

Example:

msiexec.exe /i "spiral-windows-amd64.msi" /L*vx output.txt

Validate installation

After the installation has completed, there will be a ‘Spiral’ entry under installed programs.

windows_apps.png

Figure 1: Windows apps & features

The installation folder is ‘C:\Program Files\Spiral’ with full control permissions to SYSTEM and Administrators.

This should apply to all subfolders and files with one exception ‘osquery.db’ which will have an additional read access to Everyone/World.

install_path.png

Figure 2: SamurAI Agent Windows install path and files

There will also be a service named ‘Spiral’ running.

task_manager.png

Figure 3: Task manager service

The ‘Spiral’ process will also be visible.

spiral_task_manager.png

Figure 4: Task manager process

Additionally osquery processes will be running.

windows_processes.png

Figure 5: osquery processes

The following files are created by the installer:

C:\Program Files\Spiral\bin\spiral.exe: The Spiral launcher (more details what it does and functions further down)
C:\Program Files\Spiral\bin\osqueryd.exe: The Osqueryd binary that will be launched by spiral.exe (more details further down)
C:\Program Files\Spiral\config.yaml: The configuration for Spiral launcher
C:\Program Files\Spiral\secret: The embedded tenant/enrollment secret
C:\Program Files\Spiral\ca.pem: Spiral CA bundle used to communicate with the SamurAI platform. Will download new if missing or if outdated. Used by both spiral.exe and osqueryd.exe.

The following files are created by either the ‘Spiral’ or ‘Osquery’ process:

C:\Program Files\Spiral\server.crt: Exported server certificate chain from Spiral Node API (typically excluding Root CA). 
C:\Program Files\Spiral\sysmon.xml: The sysmon configuration downloaded from Spiral Node API.
C:\Program Files\Spiral\data\osquery.db: RocksDB data folder used by Osquery for state keeping. Osquery sets this with read access to Everyone/World at intervals.
C:\Program Files\Spiral\data\extensions.load: Purposely left empty
C:\Program Files\Spiral\data\osquery.flags: Osquery startup flags (generated by Spiral), extended configuration is fetched by Osquery over HTTPS.
C:\Program Files\Spiral\data\osquery.log: Stdout/stderr log output from osqueryd.exe
C:\Program Files\Spiral\data\osquery.pid: Osquery PID
C:\Program Files\Spiral\data\osquery.uuid: UUID for this specific node
C:\Program Files\Spiral\data\spiral.log: Stdout/stderr log output from spiral.exe
C:\Program Files\Spiral\data\shell: A folder created if running spiral.exe with "shell" command which is an interactive mode to run Osquery commands.

Dependant on your selection for SamurAI Agent for Windows the agent may:

  1. Download Sysmon from Microsoft official servers.
  2. Install or update Sysmon silently using standard Microsoft provided installation flags.
  3. Modify Sysmon with the SamurAI Agent configuration.

Review Deployed SamurAI Agents

Review and Manage within the SamurAI MDR Portal.