KAPE had several updates during Q3 2022. Below, please find a recap of all the important enhancements and news from July through September 2022.
Key Q3 2022 KAPE Updates
- Official EZ Tools Manuals have been released
- Modules created/updated for multiple open-source tools
- Q3 2022 KapeFiles Changes
Official EZ Tools Manuals Have Been Released
Eric Zimmerman and Andrew Rathbun have been working on creating manuals for the EZ Tools suite. Given that they are some of the most widely used and taught tools in the DFIR community, it only seemed fitting for official manuals to be created. On October 1, 2022, we released EZ Tools Manuals on Leanpub. Any issues with the book can be reported here.
We will continually update the manuals, so “check” the “New version available” box to be notified for new releases.
Modules Have Been Created/Updated for Multiple Open-Source Tools
Another module for an EZ Tool has been added to KAPE. iisGeoLocate now has a Module that can be used against IIS Logs. Combined with the IISLogFiles Target, KAPE can acquire IIS Logs and parse them with iisGeoLocate. Please note that iisGeoLocate is not added to !EZParser at this time as the IISLogFiles Target isn’t a part of KapeTriage.
In addition, a Module was created for Reg_hunter, which is a Registry threat hunting tool. There are multiple Modules within KAPE to leverage the power of this tool.
Modules for Hayabusa have been updated, renamed and moved into their own dedicated folder. Hayabusa is similar to Chainsaw in that it leverages Sigma rules as well as its own Hayabusa Rules, which can be found here.
Chainsaw 2.0 has also been released. The Chainsaw Module has been updated to reflect the new syntax in Chainsaw 2.0 and newer.
Lastly, a Module was created for WMI-Parser. Combined with the WBEM Target, examiners can obtain OBJECTS.DATA and parse it with WMI-Parser with hopes to locate threat actor persistence.
Q3 2022 KapeFiles Changes
Here is an overview of the changes to the KapeFiles GitHub repository from July 1, 2022 to September 30, 2022.
KAPE-Related GitHub Repositories
Our experts recommend “watching” the following GitHub repositories for KAPE-related updates:
- KAPE Targets and Modules
- Registry Explorer/RECmd Plugins
- RECmd Batch Files
- SQLECmd Maps
- EvtxECmd Maps
- All of Eric Zimmerman’s GitHub repositories
Looking for the EZ button to keep KAPE, EZ Tools and the ancillary files associated with your instance(s) of KAPE? Check out the PowerShell script created by Kroll’s Andrew Rathbun here to ensure your copy of KAPE is being updated.
If you need additional KAPE support, explore our virtual live training and certification opportunities or contact our experts at [email protected]. An enterprise license is required when KAPE is used on a third-party network and/or as part of a paid engagement.
This article was written by Andrew Rathbun, a vice president in Kroll's Cyber Risk practice.
Stay Ahead with Kroll
Cyber and Data Resilience
Kroll merges elite security and data risk expertise with frontline intelligence from thousands of incident response, regulatory compliance, financial crime and due diligence engagements to make our clients more cyber resilient.
Kroll Artifact Parser And Extractor (KAPE)
Kroll's Artifact Parser and Extractor (KAPE) – created by Kroll senior director and three-time Forensic 4:cast DFIR Investigator of the Year Eric Zimmerman – lets forensic teams collect and process forensically useful artifacts within minutes. Get more information on KAPE, access training materials or book a live session with a Kroll expert here.
24x7 Incident Response
Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.
Data Recovery and Forensic Analysis
Kroll's expertise establishes whether data was compromised and to what extent. We uncover actionable information, leaving you better prepared to manage a future incident.
Cyber Risk Retainer
Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.
Computer Forensics
Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.
KAPE Resources
This page houses official documentation relating the Kroll Artifact Parser and Extractor (KAPE). It will also contain the latest KAPE news, as well as webcasts, case studies, tutorials and other training materials. For any KAPE related questions or assistance with customizations, please contact [email protected].
Incident Response & Recovery
Kroll’s elite security leaders deliver rapid responses for over 3,000 incidents per year and have the resources and expertise to support the entire incident lifecycle, including litigation demands. Gain peace of mind in a crisis.
Explore insights
