Detailed PE import analysis with pattern detection and API enrichment. Extracts all imports, detects injection/evasion/persistence patterns with MITRE ATT&CK mapping, and optionally enriches with API definitions.

Detect injection/evasion/persistence API patterns from PE imports. Returns matched patterns with MITRE ATT&CK technique IDs and risk levels.

Look up Windows API definition (signature, params, DLL, category) from the API Monitor knowledge base. Supports wildcards (e.g., 'Create*').

Browse/search Windows APIs by category. Categories are hierarchical (e.g., 'Data Access and Storage/Local File Systems/File Management').

Get a context window of API calls around a specific record index. Returns detailed call records in the range [call_index-before, call_index+after]. Useful for understanding what happened immediately before and after a suspicious call.

Track handle values across API calls to reconstruct operation chains. Identifies handle-producing APIs (OpenProcess, CreateFile, etc.) and traces where those handles are consumed (VirtualAllocEx, WriteProcessMemory, etc.). Reveals attack chains like: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.

Detect injection/evasion/persistence patterns in APMX captured API calls. Analyzes runtime behavior (actually-called APIs) against known attack patterns with MITRE ATT&CK technique IDs. Returns risk level and suspicious call timeline.

Extract detailed API call records with parameter values, return values, and timestamps from an APMX capture. Shows pre-call and post-call parameter values, identifies return values by comparing pre/post state, and extracts embedded strings. Use call_indices for specific records or api_filter to search.

Extract API call records from an APMX capture with filtering and pagination. Each record shows the top-level API and any nested calls made within it.

Extract enriched injection chain details from an APMX capture. Returns target PID, target process name, shellcode size (requested vs aligned), start address, and injection technique label. Wraps handle correlation with parameter decoding for a forensic-friendly summary.

Parse Rohitab API Monitor capture file (.apmx64/.apmx86). Returns process info (name, PID, path, command line), loaded modules, and API call count. Use this first to understand what's in a capture.

Search API calls by parameter value in an APMX capture. Finds all calls where a specific integer (e.g., PID, handle, size) or string appears as a parameter value. Returns matching calls with the matched parameters highlighted.

Parse browser history and downloads from Edge, Chrome, or Firefox. Answers: What URLs did the user visit? What files were downloaded? Where did downloads originate from?

Build comprehensive forensic timeline from multiple artifact sources (MFT, USN Journal, Prefetch, Amcache, EVTX). Returns sorted, deduplicated events. Answers: What happened and when? Provides unified chronological view of system activity.

Parse Amcache.hve to extract program execution evidence with SHA1 hashes, file paths, and timestamps. Proves a file existed and was prepared for execution.

Parse $MFT (Master File Table) for file metadata, NTFS alternate data streams (ADS), and timestomping detection. Compares $STANDARD_INFORMATION and $FILE_NAME timestamps to identify manipulation. Answers: When was this file actually created? Has it been timestomped? Does it have named streams?

Parse Windows Prefetch files to determine program execution history, run counts, and last execution times. Can parse a single .pf file or an entire Prefetch directory. Supports pagination.

Parse SRUDB.dat for raw application resource counters and network bytes sent/received. Supports application and UTC time filters, derived MB/MiB, and optional network aggregation. Resource counters are not interpreted as elapsed runtime.

Parse $UsnJrnl:$J (USN Journal) for file system change history. Records file creation, deletion, modification, and rename operations. Answers: What files were created/deleted/renamed? When did file changes occur?

Compact TSV summary of security events for rapid triage. Returns one tab-separated line per event with only attack-relevant columns. Fits entire attack chains in a single call. Types: process_creation (Timestamp|User|ParentProcess|CommandLine), logon (Timestamp|User|SourceIP|LogonType), account_created (Timestamp|NewUser|CreatedBy), scheduled_task, service_installed.

Find subject/target occurrences of one logon ID in an explicit time window (maximum seven days). Rows retain computer, role, original ID and event reference; matching IDs alone do not establish identity across hosts or reboots.

Describe a security-descriptor value in a source-bound EVTX event. Preserves provenance and reports source placeholders such as Malformed Security Descriptor without inventing missing SIDs.

Get description of a Windows Event ID.

Persist all selected EVTX matches in a unique JSONL file with SHA-256 and a bounded preview. Explicit scan/row caps report incomplete; preview clipping does not discard file rows.

Retrieve a full normalized event using a source-bound event_ref from evtx_search. Never shortens evidence fields.

Get statistics about an EVTX file: event counts, time range, Event ID distribution.

List all EVTX (Windows Event Log) files in a directory.

Summarize NTLM Operational events 4021/4022/4023, aggregate repeated shapes, and explicitly order rare process/user combinations first. Preserves counts, timestamps and event references, with bounded distributions and honest unknown statuses.

Search EVTX events by time, Event ID, keywords, or provider. Supports compact structured projection, whole-record budgets, and source-bound continuation cursors. File-record order is preserved.

Search Security events by named type, with the same compact fields, response budgets, and continuation controls as evtx_search.

Perform static analysis on Windows PE files (EXE/DLL/SYS). Extracts headers, imports, exports, sections, hashes, Authenticode metadata including SpcSpOpusInfo program name, and suspicious indicators.

List important Event IDs for a log channel.

List forensically important registry keys.

Hunt for IOC (hash, filename, IP, domain) across all forensic artifacts. Searches Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, EVTX logs, and optionally YARA rules. Answers: Where does this IOC appear? Was this file/hash/domain seen on the system? Is it known malware?

Hunt behavioral IoCs from a metadata pack across exported logs, text artifacts, filenames, and PCAP payloads. Bundled pack: impacket-iocs.

Import pre-parsed CSV from Eric Zimmerman tools (MFTECmd, PECmd, AmcacheParser, SrumECmd) for querying. Auto-detects CSV type by column headers. Useful when you already have parsed output from EZ tools.

Comprehensive execution analysis. Correlates Prefetch, Amcache, and SRUM to prove or disprove binary execution. Answers: Was this binary executed? When? How long did it run? Provides confidence scoring and unified timeline.

Comprehensive user activity investigation. Correlates Browser History, ShellBags, LNK files, and RecentDocs to build a complete picture of user activity. Answers: What did the user browse? What files did they access? What folders did they navigate?

List bundled and optional external behavioral IoC packs, including license metadata and rule counts.

Read domain metadata and evidence-backed forest-root identification from offline NTDS. Local-domain attribution retains relationship/liveness uncertainty; no SID-prefix guessing or credential extraction.

Read allowlisted offline NTDS metadata for one exact SAM name. Retained deleted/recycled matches are flagged; duplicate matches are explicit. Does not decrypt credentials or require SYSTEM.

Resolve an exact SAM selector to offline NTDS SID metadata. Reports not-found, ambiguity, and incomplete evidence explicitly; never selects an arbitrary duplicate.

Read paginated offline trusted-domain metadata: partner, SID, direction/type/attributes, and provenance. Excludes trust authentication secrets; never replays logs or repairs the database.

Get registry key and values from a hive file.

Get network configuration from SYSTEM hive.

Get persistence mechanisms (Run keys, Winlogon values, services) from registry.

Get OS version, computer name, timezone from registry.

Get USBSTOR device identities and WPD names from SYSTEM hive. first_connected is the legacy USBSTOR key last-write timestamp.

Get user accounts from SAM hive.

Query registry values with exact, substring, or regex matching, subtree scope, field projection, and pagination. Returns results and total_matched over the readable subtree, with read diagnostics. Follow next_offset for the next page.

Search registry values by pattern.

Decode bounded self-relative Windows security-descriptor bytes from explicit hex or base64. Reports owner/group, ACL states, ACE masks/SIDs and structural diagnostics; does not infer effective access.

Parse Windows shortcut (.lnk) files to determine target paths, access times, and volume information. Answers: What files did the user access recently? What were the original file locations?

Parse ShellBags to reveal folder navigation history, including UNC network shares and the interior of ZIP archives browsed in Explorer. Parses BOTH the UsrClass.dat BagMRU and the matching NTUSER.DAT BagMRU (auto-detected), since some entries exist in only one hive. Reports long folder names, created/modified times and 'last_viewed' (last interacted). Answers: Which folders did the user access? When did they browse suspicious paths? What network shares and archives did they open?

Parse an explicit Windows Search EDB using SIDR 0.9.2. Returns file, internet history, and activity history reports with extraction completeness and evidence hashes. Uses a partial PropertyStore fallback if SIDR is absent. Text filters are case-insensitive substrings combined with AND. Time bounds are inclusive UTC: file DateModified, internet Link_DateVisited, activity StartTime. Incomplete zero results are not conclusive.