# CyberKit

I built these forensics tools, references, and drills for DFIR work. Nothing you load leaves the page.

## tools

- [PE Header Explorer](https://www.cyberkit.win/tools/pe-explorer/): Parse a local EXE or DLL down to its headers, sections, imports, and imphash.
- [Prefetch Parser](https://www.cyberkit.win/tools/prefetch-parser/): Pull the executable name, run count, and last-run times out of a Windows Prefetch (.pf) file.
- [LNK Parser](https://www.cyberkit.win/tools/lnk-parser/): Parse a .lnk shortcut's headers and its embedded target path.
- [Hive Explorer](https://www.cyberkit.win/tools/hive-explorer/): Open an offline Registry hive and walk its keys and values.
- [Timestomp Analyzer](https://www.cyberkit.win/tools/mft-usn-analyzer/): Compare the $SI and $FN timestamps in a raw MFT or USN record.
- [Recycle Bin Parser](https://www.cyberkit.win/tools/recycle-bin-parser/): Decode a Recycle Bin $I file for its original path, size, and deletion time. Both format versions work.
- [Linux Explainer](https://www.cyberkit.win/tools/linux-explainer/): Read an auditd record or a systemd unit, field by field.
- [Plist Decoder](https://www.cyberkit.win/tools/plist-decoder/): Decode a macOS property list, binary or XML, in your browser.
- [Registry Decoder](https://www.cyberkit.win/tools/registry-decoder/): Decode UserAssist, ShimCache, and other binary Registry values locally.
- [EVTX Reader](https://www.cyberkit.win/tools/evtx-reader/): Read a Windows event log as XML, with its shared templates resolved.
- [PCAP Triage](https://www.cyberkit.win/tools/pcap-triage/): A first pass over a capture: conversations, protocol mix, DNS, HTTP hosts, and TLS names.
- [OLE Explorer](https://www.cyberkit.win/tools/ole-explorer/): Walk a legacy Office document's storages and streams, and see what it carries.
- [Binary Explorer](https://www.cyberkit.win/tools/binary-explorer/): Read an ELF or Mach-O header, its segments, its libraries, and how it was built.
- [PDF Explorer](https://www.cyberkit.win/tools/pdf-explorer/): See a PDF's objects, and the keys that make it act rather than display.
- [Domain Scorer](https://www.cyberkit.win/tools/domain-scorer/): Score a hostname, or a list of them, against published string heuristics. Each score is explained.
- [IOC Extractor](https://www.cyberkit.win/tools/ioc-extractor/): Paste a log or a report, and pull out every IOC in it.
- [Email Header Analyzer](https://www.cyberkit.win/tools/email-header-analyzer/): Walk the Received chain, and read the SPF, DKIM, and DMARC verdicts.
- [JWT Decoder](https://www.cyberkit.win/tools/jwt-decoder/): Decode a JSON Web Token's header, payload, and claims. It does not verify the signature.
- [User-Agent Parser](https://www.cyberkit.win/tools/user-agent-parser/): Parse a raw User-Agent header into browser, engine, and OS, with every caveat spelled out.
- [Event XML Explainer](https://www.cyberkit.win/tools/event-xml/): Split a Windows event record into its header and data, with logon types, NTSTATUS codes, and the Keywords mask decoded. It reads XML exports, not binary .evtx.
- [Suricata Rule Explainer](https://www.cyberkit.win/tools/suricata-explainer/): Read a Suricata or Snort rule back in plain English: the seven header fields, every option, and each content modifier next to the match it belongs to.
- [Certificate Decoder](https://www.cyberkit.win/tools/certificate-decoder/): Decode a PEM X.509 certificate: subject, issuer, validity, alt names, key usage, extensions, and fingerprints. It decodes only. It cannot verify a signature or a chain.
- [Entropy & Strings](https://www.cyberkit.win/tools/entropy-strings/): Measure Shannon entropy across a blob, window by window, to find packed or encrypted regions. It also lists every printable ASCII and UTF-16 run.
- [SID & Access Mask Decoder](https://www.cyberkit.win/tools/windows-sid/): Break a Windows SID into its authority, sub-authorities, and RID, and an access mask into the rights it grants. It decodes structure only. A RID above 1000 needs a domain controller to name.
- [MAC Analyzer](https://www.cyberkit.win/tools/mac-address/): Split a MAC address into its OUI and NIC bytes, and see what the U/L and I/G bits mean. It decodes structure only and does not name the manufacturer.
- [Cron Parser](https://www.cyberkit.win/tools/cron-parser/): Turn a crontab(5) expression into plain English, or build one field by field.
- [Hash Calculator](https://www.cyberkit.win/tools/hash-calculator/): Compute, verify, and identify hashes in your browser.
- [Timestamp Converter](https://www.cyberkit.win/tools/timestamp-converter/): Convert both ways across 19 timestamp and epoch formats.
- [Deobfuscator](https://www.cyberkit.win/tools/deobfuscator/): Chain Base64, hex, XOR, and gzip steps to encode a payload or peel one back.
- [Subnet & VLAN Calculator](https://www.cyberkit.win/tools/cidr-calculator/): Get the network, broadcast, netmask, and host range from CIDR notation, plus a subnet and VLAN planner.
- [Text Diff Tool](https://www.cyberkit.win/tools/text-diff/): Compare two logs or blocks of text, and see what changed.
- [Severity Matrix](https://www.cyberkit.win/tools/severity-matrix/): Score an incident across five dimensions, and see the reasoning behind it.
- [CVSS Calculator](https://www.cyberkit.win/tools/cvss-calculator/): Pick the CVSS v3.1 Base metrics, or paste a vector string, and get the score and severity band.
- [Number Base Converter](https://www.cyberkit.win/tools/base-converter/): Convert between binary, octal, decimal, and hexadecimal as you type, with an ASCII read of the bytes.
- [Data Size Converter](https://www.cyberkit.win/tools/data-size-converter/): Convert between bits, bytes, and decimal and binary units, and see why a "500 GB" drive shows less.
- [Regex Tester](https://www.cyberkit.win/tools/regex-tester/): A live regex playground, with a library of common DFIR patterns.
- [KQL Builder](https://www.cyberkit.win/tools/kql-builder/): Assemble a Kusto hunting query for Defender XDR or Sentinel against real, documented table columns.
- [CrowdStrike LogScale Builder](https://www.cyberkit.win/tools/crowdstrike-builder/): Build a Falcon LogScale query for Advanced Event Search: an event type, field filters, a groupBy, and a sort.
- [SPL Builder](https://www.cyberkit.win/tools/spl-builder/): Compose a Splunk search step by step: a base search, then stats, table, sort, where, and eval.
- [SentinelOne Builder](https://www.cyberkit.win/tools/s1-builder/): Compose a SentinelOne Deep Visibility PowerQuery against verified field names.
- [Sigma Tester](https://www.cyberkit.win/tools/sigma-tester/): Build or paste a Sigma rule, and test it against sample events.
- [YARA Tester](https://www.cyberkit.win/tools/yara-tester/): Build a YARA rule string by string, and scan a pasted sample live. The matching is real and byte-level.
- [Report Generator](https://www.cyberkit.win/tools/report-generator/): Write an incident report with a timeline, evidence and chain of custody, an artifact index, findings, indicators, ATT&CK mapping, and queries. Export it as PDF, HTML, or Markdown.
- [Triage Builder](https://www.cyberkit.win/tools/triage-builder/): Build a host collection command list, ordered by volatility.
- [OSINT Toolkit](https://www.cyberkit.win/tools/osint/): A search-operator (dork) builder, plus recon recipes.

## references

- [Event ID Reference](https://www.cyberkit.win/reference/event-ids/): The Windows Security and Sysmon event IDs that matter for DFIR.
- [CloudTrail Events](https://www.cyberkit.win/reference/cloudtrail-events/): AWS CloudTrail event names, indexed by what each one means in an investigation.
- [Entra ID Sign-ins](https://www.cyberkit.win/reference/entra-signin/): AADSTS result codes and risk detections, read as investigative signals.
- [M365 Audit Log](https://www.cyberkit.win/reference/m365-audit-log/): Unified audit log operations, indexed by what each one proves in a BEC case.
- [Registry Keys](https://www.cyberkit.win/reference/registry-keys/): Forensically useful Registry keys, indexed by the question each one answers.
- [Okta System Log](https://www.cyberkit.win/reference/okta-events/): Okta System Log event types, indexed by what each one tells an investigator.
- [capa Namespaces](https://www.cyberkit.win/reference/capa-namespaces/): How to read a capa report, and how much weight each namespace deserves.
- [File Hashes](https://www.cyberkit.win/reference/file-hashes/): imphash, ssdeep, TLSH, and so forth: what survives a change, and what a match lets you claim.
- [Practice Evidence](https://www.cyberkit.win/reference/practice-data/): Public disk images, captures, logs, and challenges, and what each one is good for.
- [ATT&CK Data Sources](https://www.cyberkit.win/reference/data-sources/): Which log actually carries each ATT&CK data source, on each platform.
- [Zeek Logs](https://www.cyberkit.win/reference/zeek-logs/): The Zeek logs an investigation reads, and the fields that decide something.
- [Linux Artifacts](https://www.cyberkit.win/reference/linux-artifacts/): Linux forensic artifacts, indexed by the question each one answers.
- [macOS Artifacts](https://www.cyberkit.win/reference/macos-artifacts/): macOS forensic artifacts, indexed by the question each one answers.
- [Network Ports](https://www.cyberkit.win/reference/network-ports/): TCP and UDP ports that matter for DFIR, each cited with a confidence level.
- [IP & CIDR Reference](https://www.cyberkit.win/reference/ip-cidr/): Special-use IPv4 and IPv6 ranges from IANA, plus a CIDR quick reference.
- [HTTP Status Codes](https://www.cyberkit.win/reference/http-status-codes/): Every IANA-assigned HTTP status code, grouped by class, with its exact reason phrase.
- [DNS Records](https://www.cyberkit.win/reference/dns-records/): The common DNS record types, such as A, MX, TXT, NS, etc., with each TYPE value and its purpose.
- [ASCII Table](https://www.cyberkit.win/reference/ascii-table/): The full 7-bit ASCII table in decimal, hex, octal, and binary, plus how Unicode and UTF-8 relate to it.
- [Glossary](https://www.cyberkit.win/reference/glossary/): A glossary of cybersecurity and DFIR terms.
- [Command Reference](https://www.cyberkit.win/reference/command-cheatsheet/): Verified DFIR commands, grouped by platform.
- [Regex Cheat Sheet](https://www.cyberkit.win/reference/regex-cheatsheet/): JavaScript regex syntax, token by token, searchable by category.
- [KQL Cheat Sheet](https://www.cyberkit.win/reference/kql-cheatsheet/): Kusto syntax for hunting in Defender XDR and Sentinel: operators, time windows, joins, and aggregation.
- [SPL Cheat Sheet](https://www.cyberkit.win/reference/spl-cheatsheet/): Splunk SPL: search commands, eval functions, stats, and field extraction.
- [SentinelOne Cheat Sheet](https://www.cyberkit.win/reference/s1-cheatsheet/): SentinelOne Deep Visibility and PowerQuery syntax. Every field name traces to a published source.
- [TLS Fingerprints](https://www.cyberkit.win/reference/tls-fingerprints/): What JA3 and JA4 identify, and what they cannot tell you.
- [Volatility Plugins](https://www.cyberkit.win/reference/volatility-plugins/): Volatility 3 plugins, indexed by the question each one answers and where each one misleads.
- [IR Playbooks](https://www.cyberkit.win/reference/ir-playbooks/): Ransomware, BEC, stolen cloud credentials, and insider theft, written as decisions.
- [Notification Clocks](https://www.cyberkit.win/reference/notification-clocks/): What starts a breach reporting deadline, not only how long it runs.
- [IR Lifecycle](https://www.cyberkit.win/reference/ir-lifecycle/): The four NIST SP 800-61 phases, and which pages here serve each one.
- [Order of Volatility](https://www.cyberkit.win/reference/order-of-volatility/): What to collect first, what it answers, and what collecting it costs.
- [Tool Catalog](https://www.cyberkit.win/reference/tool-catalog/): Free and open-source DFIR tools, grouped by platform.
- [OSI & TCP/IP Model](https://www.cyberkit.win/reference/osi-model/): The seven-layer OSI model and the practical four-layer TCP/IP model, what runs at each layer, and the three port ranges.
- [ATT&CK Map](https://www.cyberkit.win/reference/attack-map/): The MITRE ATT&CK techniques this site covers.
- [Threat Actors](https://www.cyberkit.win/reference/threat-actors/): Threat actor groups documented by MITRE, with their aliases, techniques, and known tooling.
- [D3FEND Map](https://www.cyberkit.win/reference/d3fend/): MITRE D3FEND defensive techniques, mapped to ATT&CK.
- [Cyber Kill Chain](https://www.cyberkit.win/reference/kill-chain/): Lockheed Martin's seven-phase intrusion model, phase by phase, mapped to MITRE ATT&CK where it fits.
- [Pyramid of Pain](https://www.cyberkit.win/reference/pyramid-of-pain/): David Bianco's six indicator types, from hash values to TTPs, ranked by what each one costs the adversary.

## drills

- [CloudTrail Triage](https://www.cyberkit.win/drills/cloudtrail/): Read AWS CloudTrail records, and decide what the identity was actually doing.
- [PCAP Triage Drill](https://www.cyberkit.win/drills/pcap/): Work one capture from scope to beacon through conversations, DNS, HTTP, and TLS. The PCAP tool's own parser checks the answers.
- [Phishing Headers](https://www.cyberkit.win/drills/phishing/): Pull the deciding values out of raw email headers, and say what they establish.
- [Timeline Reconstruction](https://www.cyberkit.win/drills/timeline/): Order findings from mixed sources, and say which artifact could answer the question at all.
- [Timestamps](https://www.cyberkit.win/drills/timestamps/): Read a bare integer for what it is, and say what the wrong epoch would have produced.
- [Collection Order](https://www.cyberkit.win/drills/volatility/): Order what you collect for a scenario, and say what each choice costs.
- [Linux Triage](https://www.cyberkit.win/drills/linux/): Read Linux evidence, say who did what, and say what it cannot tell you.
- [Registry Artifacts](https://www.cyberkit.win/drills/registry/): Say what a Registry finding proves, and what it only appears to prove.
- [Identity Attack Triage](https://www.cyberkit.win/drills/identity-triage/): Name the identity attack from the logs, then pick the containment that works.
- [Windows Event IDs](https://www.cyberkit.win/drills/event-ids/): Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.
- [MITRE ATT&CK](https://www.cyberkit.win/drills/attack/): Name the technique behind a real, documented procedure, and put an intrusion back in order.
- [Hash Identification](https://www.cyberkit.win/drills/hashing/): Identify a hash by its length and shape, and sort algorithms by what they are still safe for.
- [RegEx Range](https://www.cyberkit.win/drills/regex/): Build a working pattern against real sample text, one construct at a time.
- [Subnetting](https://www.cyberkit.win/drills/ip-cidr/): Work out what a CIDR block actually contains, and which special-use range an address falls in.
- [Decode & Convert Drill](https://www.cyberkit.win/drills/decode/): Identify an opaque value as a timestamp format or an encoding, then read it. The site's own converter and codecs generate every value.
- [Network Reference Drill](https://www.cyberkit.win/drills/network-ref/): Quick recall of the ports, HTTP status codes, and DNS record types that come up in triage. The questions come from the same tables as the reference pages.
- [Query Pipeline Drill](https://www.cyberkit.win/drills/query-pipeline/): Put KQL and SPL pipeline stages in the order that works: filters before aggregations, and sort before truncate.
- [CVSS Scoring Drill](https://www.cyberkit.win/drills/cvss/): Read a real vulnerability, and pick the eight CVSS v3.1 Base metrics that score it. Every answer is FIRST.org's published vector, scored by the same code as the calculator.
- [YARA Rule Drill](https://www.cyberkit.win/drills/yara/): Write a YARA rule that matches the right samples and stays quiet on the rest. The YARA Tester's engine grades it live, including samples you never see.
- [Sigma Rules](https://www.cyberkit.win/drills/sigma/): Write a detection rule that fires on the events that matter and stays quiet on the ones that do not.
- [Terminal Commands](https://www.cyberkit.win/drills/commands/): Run real investigative commands against a simulated host in bash, cmd, or PowerShell.
- [Threat Actor / APT](https://www.cyberkit.win/drills/threat-actors/): Resolve aliases and tooling to the group behind them, and tell similar actors apart.