Skip to content

KAPE_Notes.md

Latest commit

 

History

History
executable file
·
149 lines (82 loc) · 6.15 KB

KAPE_Notes.md

File metadata and controls

executable file
·
149 lines (82 loc) · 6.15 KB

KAPE

Intro

How it works

  • Adds file masks (per module) to a queue.
  • 1) Finds and copies files from a source location
    • Will then build a list of files
    • If a file is locked/protected/in-use, KAPE will come back to it on a second run. These are added to a secondary queue.
  • 2) The output from the programs is then saved in directories named after a category (ex: EvidenceOfExecution (includes prefetch, shimcache, userassist, etc), BrowserHistory)

Flowchart

  • During the secondary queue execution, KAPE uses raw disk reads to bypass the locks (enter memory forensics).
  • Metadata is collected into log files as well
  • Any target or module in the !Disabled directory will not be available in (G)Kape

1. Targets

  • Collections of file and directory specifications Target Ex - !ALL
  • After the list of files is built, targets are run
  • Targets have a .tkape extension
  • Doc src
  • See more below

2. Modules (think Vol.py capabilities)

  • Can target anything, including files collected via target capabilities (since targets run first)
  • Can even run the output of live executables; Ex: Dump netstat.exe to file
  • Modules have a .mkape extension
  • See more below

Module Example - PECmd

Targets In-Depth

  • Create new ones with the facts that they should target specific artifacts that can be grouped together
  • Category field is super important
  • FileMask field will match extensions only
  • Can also compound Targets by just setting their Path field to another, more "fine-grained" target
  • Docs Src

Modules In-Depth

  • A module’s job is to run programs against files, often generating output in the form of CSV or text that can then be reviewed by an examiner.

  • NOTE: Modules can only run ONE command; as such, you need a module for every executable you want to run against collected data.

  • FileMask field here is useful for targeting specific files; like $MFT.

  • Must include Processor field; at least one but can have more

    • If more it is for a slight variation of the cmd; e.g. export formats, recurse 3 or 4 times, etc.

    • Can either be an executable or CommandLine

    • Executable

      • Required. The path to the executable is NOT necessary and only the name of the executable (with extension)
      • Chosen executable should be placed in [KAPE directory]\Modules\bin
      • Symbolic links can be done but have to use the /h switch

    • CommandLine

      • Required. Do NOT try to use redirection.
      Module CommandLine Example

    • ExportFormat

      • Required. Ex: ExportFormat: csv

    • ExportFile

      • Optional. Ex: ExportFile: devices.txt

    • Append

      • Optional. For example, this is useful for processing several ntuser.dat hives and getting all the output in a single file, vs one file per ntuser.dat hive.

  • Docs Src

Fun Features

  • Metrics related to KAPE activity is displayed in the Title bar of the console window.
  • Long file names supported. However, when using containers they can only handle 255 chars
  • Update KAPE's targets and modules with: kape --sync
  • Update KAPE itself with Get-KAPEUpdate.ps1 script
  • Can automate with Batch Mode
  • Can be done over SFTP
  • Can change "All at once" processing to Linear via the --ul switch.
  • Other Tips & Tricks
    • Use environment variables in KAPE: echo "--mdest c:\temp\out%COMPUTERNAME%"
    • KAPE should best be run as system.
  • KAPE supports proxy

Sources

Things for Later