DFIR Reference v0.1

Windows Forensic
Reference Tools

Self-contained, offline-capable DFIR reference pages for Windows artifact analysis. Download any tool as a single HTML file and use it anywhere.

251 Registry Artifacts
399 Security Event IDs
30 Sysmon Event IDs
275 Sigma Rules
🗂️
Windows Registry
Artifact Explorer
Forensic Artifacts · ATT&CK Mapping · LOLRMM

Comprehensive registry artifact reference covering persistence, execution, user activity, credential access, and network configuration. Includes 23 LOLRMM-abused RMM tools, 70 ATT&CK techniques, and notable attacker tools with forensic guidance.

251 Artifacts 16 Categories 70 ATT&CK Techniques 23 RMM Tools RegRipper 3.0/4.0 Autoruns RECmd · SBECmd AmcacheParser
🔑
Windows Security
Event ID Reference
Security.evtx · Appendix L · Sigma Rules

Complete Security.evtx event ID reference with Microsoft Appendix L criticality tiers (High/Medium/Low), investigation notes for key events, and 60 curated Sigma detection rules with full-database search across 195 rules.

399 Event IDs 8 Categories 60 Sigma Rules Microsoft Appendix L Kerberoasting DCSync Pass-the-Hash
🔵
Sysmon
Event ID Reference
Sysmon v15.2 · Sigma Rules · Full DB Search

Complete Sysmon v15.2 reference covering all 30 event IDs with key fields, noise level ratings, configuration guidance, and 80 curated Sigma detection rules. Full-database search across 195 Sysmon-specific detection rules via companion JSON.

30 Event IDs Sysmon v15.2 80 Curated Rules 195 Rule Database Noise Levels Config Guidance BYOVD · Hollowing
Quick References

Focused, cross-channel references for activity types that span multiple log sources — faster to scan than the full explorers above. Browse all references →

🖥️
RDP Event Reference
4 Log Channels · Lateral Movement

Security, TerminalServices-RemoteConnectionManager, LocalSessionManager, and RDPCoreTS. Brute force, session hijacking, mass lateral movement.

15 Events 6 Sigma Rules
🧱
Windows Firewall Event Reference
3 Log Sources · Defense Evasion

Security rule-change events, WFP connection/bind events, and the dedicated Firewall operational channel.

15 Events 6 Sigma Rules
📁
SMB Event Reference
2 Log Sources · Credential Access

Share access events plus SMBClient operational log. Lateral movement, NTDS.dit exfiltration, IPC$ enumeration.

10 Events 6 Sigma Rules
⏱️
Scheduled Task Event Reference
2 Log Channels · Persistence

Security audit events plus the always-on TaskScheduler/Operational log. Task hijacking and persistence detection.

12 Events 6 Sigma Rules
📡
BITS Event Reference
1 Log Channel · Fileless Persistence

Bits-Client/Operational log. Stealthy downloads, exfiltration, and SetNotifyCmdLine persistence.

7 Events 6 Sigma Rules
🛡️
Windows Defender Event Reference
2 Log Sources · AV Evasion

Defender operational log plus Security Center corroboration. Detection events, AV-disable evasion, Tamper Protection.

12 Events 6 Sigma Rules
💻
PowerShell Event Reference
3 Log Channels · Obfuscation Detection

Script block/module logging, legacy log, and the separate PowerShell 7 (Core) channel. AMSI bypass, credential access, download cradles.

11 Events 6 Sigma Rules
🧩
WMI-Activity Event Reference
1 Log Channel · No Sysmon Required

Native WMI-Activity/Operational log, available on every host by default. Permanent event consumers, remote execution, polling beacons.

5 Events 6 Sigma Rules
About

🗄️ What is this?

A set of self-contained HTML reference pages for Windows digital forensics and incident response. Each tool covers a specific evidence source — registry hives, Security event log, and Sysmon — with artifact documentation, forensic investigation notes, and detection rules.

Built for practitioners who need fast, offline-capable references during investigations. No login, no tracking, no dependencies beyond Google Fonts.

⚡ Sigma Detection Rules

Each tool includes a curated set of SigmaHQ detection rules hand-selected for investigative relevance. Rules are vendor-agnostic YAML — convert to Splunk, Elastic, Microsoft Sentinel, QRadar, and others via sigconverter.io.

The Sysmon tool includes a full 195-rule companion JSON database with keyword search, surfacing rules beyond the curated set.

🗺️ ATT&CK Mapping

Registry artifacts are mapped to MITRE ATT&CK Enterprise techniques — 251 total artifacts have direct technique mappings. Filter by tactic (Persistence, Credential Access, Defense Evasion, etc.) to focus investigation on relevant keys.

Security Event IDs and Sigma rules are also tagged with ATT&CK technique IDs linking directly to attack.mitre.org.

🔧 Usage & Schema Files

Each tool works fully offline — download the HTML file and open it in any browser. Filters, search, expand/collapse, copy buttons, and all cross-references work without an internet connection (Google Fonts degrades gracefully to system fonts).

The Registry and Sysmon tools are backed by versioned JSON schema files designed to be updated independently of the HTML as new artifacts, techniques, and detection rules become available:

windows_registry_artifacts_schema_v0.3.json
sysmon_rules_complete.json
linux_artifacts_schema_v0.1.json

Security Event IDs are well-documented in Microsoft Appendix L — no separate schema file is maintained for that reference.

Sources
Authoritative Sources & References
Microsoft Sysinternals Sysmon v15.2 Microsoft Appendix L: Events to Monitor Microsoft Security Auditing Events Spreadsheet Microsoft Windows Registry Reference SigmaHQ/sigma — Detection Rules (DRL 1.1) sigconverter.io — Rule Conversion MITRE ATT&CK Enterprise v18/v19 LOLRMM.io — Living Off the Land RMM RegRipper 3.0 — Harlan Carvey RegRipper 4.0 — Harlan Carvey Sysinternals Autoruns v14.11 RECmd — Eric Zimmerman SBECmd / ShellBags — Eric Zimmerman AmcacheParser — Eric Zimmerman ANSSI: Amcache.hve Analysis Hexacorn: Beyond Good Ol' Run Key Ultimate Windows Security Encyclopedia