CyberKit
I built these forensics tools, references, and drills for DFIR work. Nothing you load leaves the page.
Start with a task
- Open an artifactEVTX, MFT, registry, and other files.
- Decode a stringJWT, Base64, hashes, and encodings.
- Build a queryKQL, SPL, Sigma, and YARA.
- Practice a drillTimed recall and evidence reads.
- Read the intelSourced briefings on what is active now.
Term of the day
A communication path that conveys information in a way the system was not designed to allow, often by manipulating timing or unused fields rather than sending obvious messages. Storage channels hide data in fields; timing channels modulate the rate of events.
A new term every day at 00:00 UTC. The glossary has the rest.