Skip to main content
DFIRHub
  • Artifacts
  • Collections
  • Builder
  • Converter

Navigate

ArtifactsCollectionsBuilderConverter
GitHub(opens in new tab)

Search Windows forensic artifacts

Browse 363 KAPE artifact definitions, build collection scripts, and convert Sigma rules. All in one place.

/

Popular:AnyDesk·ScreenConnect·TeamViewerLogs·Prefetch·Amcache·Chrome·SRUM·EventLogs·JumpLists

Tools

Artifacts

Browse 363 Windows forensic artifacts with collection paths, categories, and documentation.

Collections

Pre-built collection profiles for common investigation and triage scenarios.

Script Builder

Pick the artifacts you need and generate a ready-to-run KAPE collection script.

Sigma Converter

Convert Sigma detection rules to SIEM query languages, entirely in your browser.

DFIRHub

The comprehensive resource for Windows forensic artifacts. Search, explore, and generate collection scripts for DFIR investigations.

Navigate

All ArtifactsCollectionsScript BuilderSigma Converter

Resources

GitHub(opens in new tab)KapeFiles(opens in new tab)KAPE Documentation(opens in new tab)SANS KAPE(opens in new tab)

© 2026 DFIRHub. Data sourced from KapeFiles