Rapid DFIR Triage with KAPE (Single/Few Endpoints)
Rapid artifact collection, hash verification, and triage analysis on a few endpoints where no Velociraptor agent is present or physical/remote access is available, using the KAPE `!SANS_Triage` target.
Prepare
5 steps- KAPE preparation
Keep the current KAPE version on a USB drive or network share; synchronize the `Targets/` and `Modules/` directories with the EricZimmerman/KapeFiles GitHub repository and test with `gkape.exe`
- Zimmerman Tools update
Keep MFTECmd, PECmd, JLECmd, RECmd, AppCompatCacheParser, and SrumECmd up to date with `Get-ZimmermanTools.ps1 -NetVersion 6`
- Storage preparation
Prepare an exFAT-formatted external USB drive or writable network share for triage output; never write to the target system's free space
- Time synchronization
Verify all systems are synchronized to UTC via NTP; if the offset exceeds 5 minutes, note it in the incident record
- Escalation decision
If the number of affected endpoints is 4+, an active breach is suspected, or domain compromise is present, switch to the Velociraptor Hunt Playbook (PB-B) instead of this playbook