kape

This repository serves as a place for community created Targets and Modules for use with KAPE.

A repository of DFIR-related Mind Maps geared towards the visual learners!

A curated list of KAPE-related resources

Python 3 Script to parse out iTunes backups

Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.

A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.

A script that updates KAPE (using Get-KAPEUpdate.ps1) as well as EZ Tools (within .\KAPE\Modules\bin) and the ancillary files that enhance the output of those tools

Various PowerShells scripts I've made (or others have made) to automate some of the boring stuff in my everyday DFIR journey!

A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE

Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.

A sample VHDX file with multiple verbose examples of forensic and anti-forensics artifacts. Meant to be basic and can be expanded upon. Please add a new issue if you have an idea for something to add.

Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard

A repository of output using KAPE (!EZParser Module) for various publicly available forensic images!

Orchestration Software for Incident Response

DFIR Presentations

A collection of powershell scripts that are designed to be ran from a Microsoft Defender for Endpoint Live Response terminal, utilizing open-source tools, such as Kape (Kroll Artifact Parser and Extractor), to forensically acquire and process necessary artifact used in compromise assessments. Additional scripts provide pre-processing automation …

Windows DFIR pipeline: from a KAPE collection, a memory image and network captures to an evidence-backed incident response report, with an LLM agent.

Remote KAPE collection using powershell

A powershell tool that automate the remote forensic evidence adquisitions (triage) from Remote windows machines, using KAPE tool.