# Available Windows DFIR Toolset

### Introduction

This section provides an overview of the installed DFIR toolset within the Windows Purple targets, detailing the available tools/solutions and their respective locations.

### DFIR Toolset Installed

Below is a list of the DFIR toolset installed on the Windows Purple module targets for `post-exploitation` forensic analysis purposes, along with their respective installation paths.

#### System Monitoring (Event Logging)

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Sysmon** | `C:\Windows\Sysmon64.exe` | Provides detailed event logging and detection. |

### **Log Analysis**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Eric Zimmerman Tools** | `C:\Tools\EZ-Tools` | Forensic utilities for analyzing digital evidence, such as registry hives and event logs. |

### **Threat Detection & Monitoring**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Yara** | `C:\Tools\yara\yara.exe` | Signature-based file scanning tool. |
| **Chainsaw** | `C:\Tools\Sigma\chainsaw\chainsaw_x86_64-pc-windows-msvc.exe` | Command-line tool for parsing and hunting through Windows Event Logs. |
| **Sigma** | `C:\Program Files\Python312\Scripts\sigma.exe` | Generic signature format for SIEM rule creation. |
| **Zircolite** | `C:\Tools\Sigma\zircolite\zircolite_win_x64_2.20.0.exe` | Sigma-based EVTX log analysis. |
| **Osquery** | `C:\Program Files\osquery\osqueryi.exe` | Endpoint monitoring using SQL-like queries. |
| **Velociraptor** | `C:\Program Files\Velociraptor` (`https://<Target_IP>:8889`) | Endpoint monitoring, collection, and response. |

**Notes**:

* Specify the following credentials to log into `Velociraptor`:
    
    * Username: `admin`
        
    * Password: `P3n#31337@LOG`
        
* `Allow Windows Purple module targets to run for at least 5 minutes after spawning` to ensure that all services have fully initialized (including Velociraptor).
    

### **Traffic Capturing**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Wireshark** | `C:\Program Files\Wireshark` | Packet capture tool for network traffic analysis. |

### **Memory Dumping**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **DumpIt** | `C:\Tools\Memory-Dump\DumpIt.exe` | Memory dumping utility for memory forensics. |
| **WinPmem** | `C:\Tools\Memory-Dump\winpmem_mini_x64_rc2.exe` | Memory dumping utility for memory forensics. |

### **Memory Forensics**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Volatility v2** | `C:\Tools\Volatility2` | Memory forensics tool for analyzing memory dumps. |
| **Volatility v3** | `C:\Tools\volatility3` | Memory forensics tool for analyzing memory dumps. |

### **Additional Telemetry**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **SilkETW** | `C:\Tools\SilkETW\SilkETW\SilkETW.exe` | C# wrappers for ETW. |
| **SealighterTI** | `C:\Tools\SealighterTI.exe` | Running Microsoft-Windows-Threat-Intelligence without a driver. |
| **AMSI-Monitoring-Script** | `C:\Tools\AMSIScript\`[`AMSIScriptContentRetrieval.ps`](http://AMSIScriptContentRetrieval.ps)`1` | Extracting script contents using the AMSI ETW provider. |
| **JonMon** | `C:\Tools\JonMon` | Collection of open-source telemetry sensors. |
| **Fibratus** (Added after this module's release; not available in its targets) | `C:\Program Files\Fibratus` | Adversary tradecraft detection using behavior-driven rule engine and YARA memory scanner. Event logs can be viewed in Application logs in Event Viewer |

### **Adversary Simulation**

| **Name** | **Path** | **Description** |
| --- | --- | --- |
| **Atomic Red Team** (Added after this module's release; not available in its targets) | `C:\AtomicRedTeam` | Small and highly portable detection tests based on MITRE's ATT&CK. |

### **Malware/Process/PE Analysis**

| **Tool** | **Path** | **Description** |
| --- | --- | --- |
| **CFF-Explorer** | `C:\Tools\CFF-Explorer\CFF Explorer.exe` | Tool designed for examining and editing Portable Executable (PE) files. |
| **Ghidra** | `C:\Tools\Ghidra\ghidraRun.bat` | Software reverse engineering (SRE) framework. |
| **x64dbg** | `C:\Tools\x64dbg` | Open-source x64/x32 debugger for windows. |
| **SpeakEasy** | `C:\Tools\speakeasy` | Modular, binary emulator designed to emulate Windows kernel and user mode malware. |
| **SysInternalsSuite** | `C:\Tools\SysinternalsSuite` | Sysinternals Troubleshooting Utilities. |
| **Get-InjectedThread** | `C:\Tools\`[`Get-InjectedThread.ps`](http://Get-InjectedThread.ps)`1` | Looks for threads that were created as a result of code injection. |
| **Hollows\_Hunter** | `C:\Tools\hollows_hunter64.exe` | Scans all running processes. Recognizes and dumps a variety of potentially malicious implants. |
| **Moneta** | `C:\Tools\Moneta64.exe` | Live usermode memory analysis tool for Windows with the capability to detect malware IOCs. |
| **PE-Sieve** | `C:\Tools\pe-sieve64.exe` | Detects malware running on the system, as well as collects the potentially malicious material for further analysis. |
| **API-Monitor** | `C:\Tools\API Monitor` | Monitors and controls API calls made by applications and services. |
| **PE-Bear** | `C:\Tools\PE-bear` | Multiplatform reversing tool for PE files. |
| **ProcessHacker** | `C:\Tools\ProcessHacker` | Monitors system resources, debugs software and detects malware. |
| **ProcMonX** | `C:\Tools\ProcMonX.exe` | Extended Process Monitor-like tool based on Event Tracing for Windows. |
| **Frida** (Added after this module's release; not available in its targets) | `C:\Program Files\Python312\Scripts\frida.exe` | Dynamic instrumentation toolkit for reverse-engineers. Helps to trace, instrument, debug and hook API functions |
| **LitterBox** (Added after this module's release; not available in its targets) | `C:\Tools\LitterBox\`[`litterbox.py`](http://litterbox.py) | Malware sandbox environment for payload behavior testing. |