Read allowlisted offline NTDS metadata for one exact SAM name. Retained deleted/recycled matches are flagged; duplicate matches are explicit. Does not decrypt credentials or require SYSTEM.

Resolve an exact SAM selector to offline NTDS SID metadata. Reports not-found, ambiguity, and incomplete evidence explicitly; never selects an arbitrary duplicate.

Read domain metadata and evidence-backed forest-root identification from offline NTDS. Local-domain attribution retains relationship/liveness uncertainty; no SID-prefix guessing or credential extraction.

Read paginated offline trusted-domain metadata: partner, SID, direction/type/attributes, and provenance. Excludes trust authentication secrets; never replays logs or repairs the database.

List all EVTX (Windows Event Log) files in a directory.

Get statistics about an EVTX file: event counts, time range, Event ID distribution.

Search EVTX events by time, Event ID, keywords, or provider. Supports compact structured projection, whole-record budgets, and source-bound continuation cursors. File-record order is preserved.

Search Security events by named type, with the same compact fields, response budgets, and continuation controls as evtx_search.

Find subject/target occurrences of one logon ID in an explicit time window (maximum seven days). Rows retain computer, role, original ID and event reference; matching IDs alone do not establish identity across hosts or reboots.

Persist all selected EVTX matches in a unique JSONL file with SHA-256 and a bounded preview. Explicit scan/row caps report incomplete; preview clipping does not discard file rows.

Summarize NTLM Operational events 4021/4022/4023, aggregate repeated shapes, and explicitly order rare process/user combinations first. Preserves counts, timestamps and event references, with bounded distributions and honest unknown statuses.

Decode bounded self-relative Windows security-descriptor bytes from explicit hex or base64. Reports owner/group, ACL states, ACE masks/SIDs and structural diagnostics; does not infer effective access.

Describe a security-descriptor value in a source-bound EVTX event. Preserves provenance and reports source placeholders such as Malformed Security Descriptor without inventing missing SIDs.

Retrieve a full normalized event using a source-bound event_ref from evtx_search. Never shortens evidence fields.

Compact TSV summary of security events for rapid triage. Returns one tab-separated line per event with only attack-relevant columns. Fits entire attack chains in a single call. Types: process_creation (Timestamp|User|ParentProcess|CommandLine), logon (Timestamp|User|SourceIP|LogonType), account_created (Timestamp|NewUser|CreatedBy), scheduled_task, service_installed.

Get description of a Windows Event ID.

Get registry key and values from a hive file.

Search registry values by pattern.

Query registry values with exact, substring, or regex matching, subtree scope, field projection, and pagination. Returns results and total_matched over the readable subtree, with read diagnostics. Follow next_offset for the next page.

Get persistence mechanisms (Run keys, Winlogon values, services) from registry.

Get user accounts from SAM hive.

Get USBSTOR device identities and WPD names from SYSTEM hive. first_connected is the legacy USBSTOR key last-write timestamp.

Get OS version, computer name, timezone from registry.

Get network configuration from SYSTEM hive.

List important Event IDs for a log channel.

List forensically important registry keys.

Perform static analysis on Windows PE files (EXE/DLL/SYS). Extracts headers, imports, exports, sections, hashes, Authenticode metadata including SpcSpOpusInfo program name, and suspicious indicators.

Detailed PE import analysis with pattern detection and API enrichment. Extracts all imports, detects injection/evasion/persistence patterns with MITRE ATT&CK mapping, and optionally enriches with API definitions.

Look up Windows API definition (signature, params, DLL, category) from the API Monitor knowledge base. Supports wildcards (e.g., 'Create*').

Browse/search Windows APIs by category. Categories are hierarchical (e.g., 'Data Access and Storage/Local File Systems/File Management').

Detect injection/evasion/persistence API patterns from PE imports. Returns matched patterns with MITRE ATT&CK technique IDs and risk levels.

Parse Rohitab API Monitor capture file (.apmx64/.apmx86). Returns process info (name, PID, path, command line), loaded modules, and API call count. Use this first to understand what's in a capture.

Extract API call records from an APMX capture with filtering and pagination. Each record shows the top-level API and any nested calls made within it.

Detect injection/evasion/persistence patterns in APMX captured API calls. Analyzes runtime behavior (actually-called APIs) against known attack patterns with MITRE ATT&CK technique IDs. Returns risk level and suspicious call timeline.

Extract detailed API call records with parameter values, return values, and timestamps from an APMX capture. Shows pre-call and post-call parameter values, identifies return values by comparing pre/post state, and extracts embedded strings. Use call_indices for specific records or api_filter to search.

Track handle values across API calls to reconstruct operation chains. Identifies handle-producing APIs (OpenProcess, CreateFile, etc.) and traces where those handles are consumed (VirtualAllocEx, WriteProcessMemory, etc.). Reveals attack chains like: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.

Extract enriched injection chain details from an APMX capture. Returns target PID, target process name, shellcode size (requested vs aligned), start address, and injection technique label. Wraps handle correlation with parameter decoding for a forensic-friendly summary.

Get a context window of API calls around a specific record index. Returns detailed call records in the range [call_index-before, call_index+after]. Useful for understanding what happened immediately before and after a suspicious call.

Search API calls by parameter value in an APMX capture. Finds all calls where a specific integer (e.g., PID, handle, size) or string appears as a parameter value. Returns matching calls with the matched parameters highlighted.

Parse Windows Prefetch files to determine program execution history, run counts, and last execution times. Can parse a single .pf file or an entire Prefetch directory. Supports pagination.

Parse Amcache.hve to extract program execution evidence with SHA1 hashes, file paths, and timestamps. Proves a file existed and was prepared for execution.

Parse an explicit Windows Search EDB using SIDR 0.9.2. Returns file, internet history, and activity history reports with extraction completeness and evidence hashes. Uses a partial PropertyStore fallback if SIDR is absent. Text filters are case-insensitive substrings combined with AND. Time bounds are inclusive UTC: file DateModified, internet Link_DateVisited, activity StartTime. Incomplete zero results are not conclusive.

Parse SRUDB.dat for raw application resource counters and network bytes sent/received. Supports application and UTC time filters, derived MB/MiB, and optional network aggregation. Resource counters are not interpreted as elapsed runtime.

Comprehensive execution analysis. Correlates Prefetch, Amcache, and SRUM to prove or disprove binary execution. Answers: Was this binary executed? When? How long did it run? Provides confidence scoring and unified timeline.

Build comprehensive forensic timeline from multiple artifact sources (MFT, USN Journal, Prefetch, Amcache, EVTX). Returns sorted, deduplicated events. Answers: What happened and when? Provides unified chronological view of system activity.

Hunt for IOC (hash, filename, IP, domain) across all forensic artifacts. Searches Prefetch, Amcache, SRUM, MFT, USN Journal, Browser History, EVTX logs, and optionally YARA rules. Answers: Where does this IOC appear? Was this file/hash/domain seen on the system? Is it known malware?

List bundled and optional external behavioral IoC packs, including license metadata and rule counts.

Hunt behavioral IoCs from a metadata pack across exported logs, text artifacts, filenames, and PCAP payloads. Bundled pack: impacket-iocs.

Comprehensive user activity investigation. Correlates Browser History, ShellBags, LNK files, and RecentDocs to build a complete picture of user activity. Answers: What did the user browse? What files did they access? What folders did they navigate?

Import pre-parsed CSV from Eric Zimmerman tools (MFTECmd, PECmd, AmcacheParser, SrumECmd) for querying. Auto-detects CSV type by column headers. Useful when you already have parsed output from EZ tools.

Parse $MFT (Master File Table) for file metadata, NTFS alternate data streams (ADS), and timestomping detection. Compares $STANDARD_INFORMATION and $FILE_NAME timestamps to identify manipulation. Answers: When was this file actually created? Has it been timestomped? Does it have named streams?

Parse $UsnJrnl:$J (USN Journal) for file system change history. Records file creation, deletion, modification, and rename operations. Answers: What files were created/deleted/renamed? When did file changes occur?

Parse browser history and downloads from Edge, Chrome, or Firefox. Answers: What URLs did the user visit? What files were downloaded? Where did downloads originate from?

Parse Windows shortcut (.lnk) files to determine target paths, access times, and volume information. Answers: What files did the user access recently? What were the original file locations?

Parse ShellBags to reveal folder navigation history, including UNC network shares and the interior of ZIP archives browsed in Explorer. Parses BOTH the UsrClass.dat BagMRU and the matching NTUSER.DAT BagMRU (auto-detected), since some entries exist in only one hive. Reports long folder names, created/modified times and 'last_viewed' (last interacted). Answers: Which folders did the user access? When did they browse suspicious paths? What network shares and archives did they open?