Where the evidence lives, and the command to collect it
Search 409 KAPE targets that cover 1125 paths on disk. Copy a ready-to-run command, build a collection script, or convert a Sigma rule for your SIEM.
Prefetch
2 paths, part of 6 collections.
- C:\Windows\prefetch\*.pf
- C:\Windows.old\Windows\prefetch\*.pf
Start with the question you need answered
Evidence only matters when it answers something. Pick a question to see which artifacts hold the answer.
Did this program run?
Prefetch and Amcache can still show a program after someone deletes it.
Which files did the user open?
Jump lists and LNK files list recent files with timestamps. The Recycle Bin keeps what the user deleted.
Who logged on, and from where?
Event logs record every logon. The RDP logs add the address it came from.
Did someone use remote access software?
Attackers often reuse the tools IT already trusts. Each of these keeps its own logs.
What did the user browse?
Browser profiles hold history, downloads and cache for every user on the host.
What was plugged in?
Windows remembers each USB device that connected, with the first and last time.
What survives a reboot?
Scheduled tasks, BITS jobs and registry run keys keep attacker code alive after a restart.
Find it, collect it, then hunt for it
Artifacts
Browse 409 artifacts with the folders, file masks and documentation behind each one.
Targets per category
409 targets in 7 categories
Collections
Ready-made sets for triage, like KapeTriage. Each one expands to every artifact it collects.
Script Builder
Tick the artifacts you need. Get a PowerShell, batch or WSL script, or a single KAPE command.
Sigma Converter
Convert 3,302 SigmaHQ rules, or your own, to 17 query languages. It all runs in your browser.