CyberKit

I built these forensics tools, references, and drills for DFIR work. Nothing you load leaves the page.

tools

- PE Header Explorer: Parse a local EXE or DLL down to its headers, sections, imports, and imphash.
- Prefetch Parser: Pull the executable name, run count, and last-run times out of a Windows Prefetch (.pf) file.
- LNK Parser: Parse a .lnk shortcut's headers and its embedded target path.
- Hive Explorer: Open an offline Registry hive and walk its keys and values.
- Timestomp Analyzer: Compare the $SI and $FN timestamps in a raw MFT or USN record.
- Recycle Bin Parser: Decode a Recycle Bin $I file for its original path, size, and deletion time. Both format versions work.
- Linux Explainer: Read an auditd record or a systemd unit, field by field.
- Plist Decoder: Decode a macOS property list, binary or XML, in your browser.
- Registry Decoder: Decode UserAssist, ShimCache, and other binary Registry values locally.
- EVTX Reader: Read a Windows event log as XML, with its shared templates resolved.
- PCAP Triage: A first pass over a capture: conversations, protocol mix, DNS, HTTP hosts, and TLS names.
- OLE Explorer: Walk a legacy Office document's storages and streams, and see what it carries.
- Binary Explorer: Read an ELF or Mach-O header, its segments, its libraries, and how it was built.
- PDF Explorer: See a PDF's objects, and the keys that make it act rather than display.
- Domain Scorer: Score a hostname, or a list of them, against published string heuristics. Each score is explained.
- IOC Extractor: Paste a log or a report, and pull out every IOC in it.
- Email Header Analyzer: Walk the Received chain, and read the SPF, DKIM, and DMARC verdicts.
- JWT Decoder: Decode a JSON Web Token's header, payload, and claims. It does not verify the signature.
- User-Agent Parser: Parse a raw User-Agent header into browser, engine, and OS, with every caveat spelled out.
- Event XML Explainer: Split a Windows event record into its header and data, with logon types, NTSTATUS codes, and the Keywords mask decoded. It reads XML exports, not binary .evtx.
- Suricata Rule Explainer: Read a Suricata or Snort rule back in plain English: the seven header fields, every option, and each content modifier next to the match it belongs to.
- Certificate Decoder: Decode a PEM X.509 certificate: subject, issuer, validity, alt names, key usage, extensions, and fingerprints. It decodes only. It cannot verify a signature or a chain.
- Entropy & Strings: Measure Shannon entropy across a blob, window by window, to find packed or encrypted regions. It also lists every printable ASCII and UTF-16 run.
- SID & Access Mask Decoder: Break a Windows SID into its authority, sub-authorities, and RID, and an access mask into the rights it grants. It decodes structure only. A RID above 1000 needs a domain controller to name.
- MAC Analyzer: Split a MAC address into its OUI and NIC bytes, and see what the U/L and I/G bits mean. It decodes structure only and does not name the manufacturer.
- Cron Parser: Turn a crontab(5) expression into plain English, or build one field by field.
- Hash Calculator: Compute, verify, and identify hashes in your browser.
- Timestamp Converter: Convert both ways across 19 timestamp and epoch formats.
- Deobfuscator: Chain Base64, hex, XOR, and gzip steps to encode a payload or peel one back.
- Subnet & VLAN Calculator: Get the network, broadcast, netmask, and host range from CIDR notation, plus a subnet and VLAN planner.
- Text Diff Tool: Compare two logs or blocks of text, and see what changed.
- Severity Matrix: Score an incident across five dimensions, and see the reasoning behind it.
- CVSS Calculator: Pick the CVSS v3.1 Base metrics, or paste a vector string, and get the score and severity band.
- Number Base Converter: Convert between binary, octal, decimal, and hexadecimal as you type, with an ASCII read of the bytes.
- Data Size Converter: Convert between bits, bytes, and decimal and binary units, and see why a "500 GB" drive shows less.
- Regex Tester: A live regex playground, with a library of common DFIR patterns.
- KQL Builder: Assemble a Kusto hunting query for Defender XDR or Sentinel against real, documented table columns.
- CrowdStrike LogScale Builder: Build a Falcon LogScale query for Advanced Event Search: an event type, field filters, a groupBy, and a sort.
- SPL Builder: Compose a Splunk search step by step: a base search, then stats, table, sort, where, and eval.
- SentinelOne Builder: Compose a SentinelOne Deep Visibility PowerQuery against verified field names.
- Sigma Tester: Build or paste a Sigma rule, and test it against sample events.
- YARA Tester: Build a YARA rule string by string, and scan a pasted sample live. The matching is real and byte-level.
- Report Generator: Write an incident report with a timeline, evidence and chain of custody, an artifact index, findings, indicators, ATT&CK mapping, and queries. Export it as PDF, HTML, or Markdown.
- Triage Builder: Build a host collection command list, ordered by volatility.
- OSINT Toolkit: A search-operator (dork) builder, plus recon recipes.

references

- Event ID Reference: The Windows Security and Sysmon event IDs that matter for DFIR.
- CloudTrail Events: AWS CloudTrail event names, indexed by what each one means in an investigation.
- Entra ID Sign-ins: AADSTS result codes and risk detections, read as investigative signals.
- M365 Audit Log: Unified audit log operations, indexed by what each one proves in a BEC case.
- Registry Keys: Forensically useful Registry keys, indexed by the question each one answers.
- Okta System Log: Okta System Log event types, indexed by what each one tells an investigator.
- capa Namespaces: How to read a capa report, and how much weight each namespace deserves.
- File Hashes: imphash, ssdeep, TLSH, and so forth: what survives a change, and what a match lets you claim.
- Practice Evidence: Public disk images, captures, logs, and challenges, and what each one is good for.
- ATT&CK Data Sources: Which log actually carries each ATT&CK data source, on each platform.
- Zeek Logs: The Zeek logs an investigation reads, and the fields that decide something.
- Linux Artifacts: Linux forensic artifacts, indexed by the question each one answers.
- macOS Artifacts: macOS forensic artifacts, indexed by the question each one answers.
- Network Ports: TCP and UDP ports that matter for DFIR, each cited with a confidence level.
- IP & CIDR Reference: Special-use IPv4 and IPv6 ranges from IANA, plus a CIDR quick reference.
- HTTP Status Codes: Every IANA-assigned HTTP status code, grouped by class, with its exact reason phrase.
- DNS Records: The common DNS record types, such as A, MX, TXT, NS, etc., with each TYPE value and its purpose.
- ASCII Table: The full 7-bit ASCII table in decimal, hex, octal, and binary, plus how Unicode and UTF-8 relate to it.
- Glossary: A glossary of cybersecurity and DFIR terms.
- Command Reference: Verified DFIR commands, grouped by platform.
- Regex Cheat Sheet: JavaScript regex syntax, token by token, searchable by category.
- KQL Cheat Sheet: Kusto syntax for hunting in Defender XDR and Sentinel: operators, time windows, joins, and aggregation.
- SPL Cheat Sheet: Splunk SPL: search commands, eval functions, stats, and field extraction.
- SentinelOne Cheat Sheet: SentinelOne Deep Visibility and PowerQuery syntax. Every field name traces to a published source.
- TLS Fingerprints: What JA3 and JA4 identify, and what they cannot tell you.
- Volatility Plugins: Volatility 3 plugins, indexed by the question each one answers and where each one misleads.
- IR Playbooks: Ransomware, BEC, stolen cloud credentials, and insider theft, written as decisions.
- Notification Clocks: What starts a breach reporting deadline, not only how long it runs.
- IR Lifecycle: The four NIST SP 800-61 phases, and which pages here serve each one.
- Order of Volatility: What to collect first, what it answers, and what collecting it costs.
- Tool Catalog: Free and open-source DFIR tools, grouped by platform.
- OSI & TCP/IP Model: The seven-layer OSI model and the practical four-layer TCP/IP model, what runs at each layer, and the three port ranges.
- ATT&CK Map: The MITRE ATT&CK techniques this site covers.
- Threat Actors: Threat actor groups documented by MITRE, with their aliases, techniques, and known tooling.
- D3FEND Map: MITRE D3FEND defensive techniques, mapped to ATT&CK.
- Cyber Kill Chain: Lockheed Martin's seven-phase intrusion model, phase by phase, mapped to MITRE ATT&CK where it fits.
- Pyramid of Pain: David Bianco's six indicator types, from hash values to TTPs, ranked by what each one costs the adversary.

drills

- CloudTrail Triage: Read AWS CloudTrail records, and decide what the identity was actually doing.
- PCAP Triage Drill: Work one capture from scope to beacon through conversations, DNS, HTTP, and TLS. The PCAP tool's own parser checks the answers.
- Phishing Headers: Pull the deciding values out of raw email headers, and say what they establish.
- Timeline Reconstruction: Order findings from mixed sources, and say which artifact could answer the question at all.
- Timestamps: Read a bare integer for what it is, and say what the wrong epoch would have produced.
- Collection Order: Order what you collect for a scenario, and say what each choice costs.
- Linux Triage: Read Linux evidence, say who did what, and say what it cannot tell you.
- Registry Artifacts: Say what a Registry finding proves, and what it only appears to prove.
- Identity Attack Triage: Name the identity attack from the logs, then pick the containment that works.
- Windows Event IDs: Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.
- MITRE ATT&CK: Name the technique behind a real, documented procedure, and put an intrusion back in order.
- Hash Identification: Identify a hash by its length and shape, and sort algorithms by what they are still safe for.
- RegEx Range: Build a working pattern against real sample text, one construct at a time.
- Subnetting: Work out what a CIDR block actually contains, and which special-use range an address falls in.
- Decode & Convert Drill: Identify an opaque value as a timestamp format or an encoding, then read it. The site's own converter and codecs generate every value.
- Network Reference Drill: Quick recall of the ports, HTTP status codes, and DNS record types that come up in triage. The questions come from the same tables as the reference pages.
- Query Pipeline Drill: Put KQL and SPL pipeline stages in the order that works: filters before aggregations, and sort before truncate.
- CVSS Scoring Drill: Read a real vulnerability, and pick the eight CVSS v3.1 Base metrics that score it. Every answer is FIRST.org's published vector, scored by the same code as the calculator.
- YARA Rule Drill: Write a YARA rule that matches the right samples and stays quiet on the rest. The YARA Tester's engine grades it live, including samples you never see.
- Sigma Rules: Write a detection rule that fires on the events that matter and stays quiet on the ones that do not.
- Terminal Commands: Run real investigative commands against a simulated host in bash, cmd, or PowerShell.
- Threat Actor / APT: Resolve aliases and tooling to the group behind them, and tell similar actors apart.