domains / families / security / triaging-windows-with-kape
triaging-windows-with-kape
separate
Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted
When to use
- During the early containment/triage phase of an incident when you need execution, persistence, and account artifacts from one or many hosts quickly.
- When full disk imaging is impractical (large disks, remote sites, time pressure) but you still need a defensible, parseable artifact set.
- When automating collection across a fleet via remote execution (PSExec, EDR live response, SOAR) using batch-mode `_kape.cli` files.
- When you need to collect from Volume Shadow Copies to recover historical artifact states.
When not to use
Skill page
Source