ahammadshawki8/DeepSIFT

tools

• adversarial_review

  Challenge current hypothesis with counter-arguments before finish_analysis

• correlate_artifacts

  Join findings across memory/disk/network/registry by PID, path, IP, user

• create_super_timeline

  Build a Plaso super-timeline from a disk image (long-running)

• detect_contradictions

  Find UNRESOLVED_CONTRADICTION findings: DKOM, ghost PIDs, log wipes, hidden services

• detect_packer

  Entropy analysis + UPX/MPRESS/Themida signature detection

• extract_dns_queries

  DNS extraction — DGA detection, beaconing, DNS tunneling

• extract_file

  Extract file by inode number to exports/

• extract_strings

  String extraction + IOC pattern scan (IPs, URLs, base64, registry)

• filter_timeline

  Extract events for a specific time window; highlights suspicious keywords

• find_injected_code

  malfind with injection type classification

• finish_analysis

  Structured report with grounding score, 4-axis confidence score, audit_ids citation

• get_browser_history

  Extract WEBHIST events (URLs, downloads, searches) from timeline

• get_cachedump

  Domain cached credential hashes (DCC2)

• get_callbacks

  Kernel callback registrations

• get_command_history

  cmdline with suspicious pattern detection

• get_devicetree

  Kernel device tree

• get_driverirp

  IRP dispatch table hook detection (rootkit)

• get_env_vars

  Process environment block variables

• get_file_listing

  Recursive file listing with deleted-file flags

• get_filescan

  FILE_OBJECT pool scan

• get_getsids

  Security identifiers per process (privilege enumeration)

• get_hashdump

  NTLM password hash extraction from SAM in memory

• get_ldrmodules

  Compare InLoad / InMem / InInit PEB lists

• get_loaded_dlls

  DLL listing for a specific PID

• get_lsadump

  LSA secrets from memory (service account passwords)

• get_modules

  Kernel module list; flags unsigned/suspicious drivers

• get_mutexes

  Mutex object scan (mutantscan)

• get_network_connections

  netscan with external IP flagging + MITRE tags

• get_partition_table

  Read partition layout; returns sector offsets for follow-up calls

• get_pe_metadata

  PE header, sections, imports, compile timestamp, entropy

• get_privileges

  Token privilege enumeration per PID

• get_process_list

  EPROCESS walk; SANS Hunt Evil baseline comparison

• get_registry_hives

  List hives in memory image

• get_registry_key

  Read a specific registry key from memory

• get_running_services

  svcscan with suspicious binary path detection (T1543.003)

• get_ssdt

  System Service Descriptor Table hooks

• get_timeliner

  Memory-resident timestamp timeline

• get_vad_info

  Virtual Address Descriptor tree

• list_hayabusa_rules

  Show available Hayabusa rule profiles

• list_yara_rule_sets

  Enumerate available rule sets

• lookup_ip_reputation

  AbuseIPDB + VirusTotal APIs

• parse_amcache

  Amcache.hve via AmcacheParser

• parse_arp_cache

  Volatility netstat as host enumeration proxy

• parse_event_logs

  .evtx via EvtxECmd

• parse_hayabusa

  Apply 3,700+ community Sigma rules to .evtx directory

• parse_jump_lists

  AutomaticDestinations via JLECmd

• parse_lnk_files

  Recent Items via LECmd

• parse_mft

  $MFT via MFTECmd

• parse_pcap_summary

  TShark PCAP summary — top talkers, exfil signals

• parse_prefetch

  C:\Windows\Prefetch via PECmd

• parse_recycle_bin

  $Recycle.Bin via RBCmd

• parse_registry_hive

  Any hive via RECmd

• parse_shimcache

  SYSTEM hive via AppCompatCacheParser

• parse_srum

  SRUDB.dat via SrumECmd

• parse_usn_journal

  $UsnJrnl:$J via MFTECmd

• scan_file_with_yara

  Static file scan against named rule set

• scan_hidden_processes

  pslist vs psscan diff → DKOM detection (T1014)

• scan_memory_with_yara

  Yarascan via Volatility 3 (finds memory-resident payloads)

• search_deleted_files

  List only deleted/unallocated entries

• verify_findings

  Verbatim token grounding check — every claim vs raw export bytes (run before finish_analysis)