OmniTriage

Zero-dependency, sub-second Windows live digital forensics & incident response (DFIR) triage engine for USB responders.

OmniTriage solves this cleanly: built from the ground up in 100% pure Python standard library (winreg, sqlite3, ctypes, subprocess, hashlib, struct). No pip install, no external binaries, zero disk noise, executing in under 1 second and generating an interactive, standalone dark-mode HTML report alongside structured JSON.

🚀 Key Features

• ⚡ Sub-Second Live Execution: Completes a comprehensive full-disk forensic triage in ~0.25 to 1.5 seconds.
• 🛡️ Zero 3rd-Party Dependencies: Runs out-of-the-box on any Windows machine with Python installed. Does not write temp utilities or drop executables to disk.
• 🔓 SQLite Lock Bypass (Shadow Buffer Querying): Extracts live browsing history and download logs from Chrome, Edge, and Brave even while the suspect or user has the browser actively open.
• 🧠 Program Execution Evidence:
  • PSReadLine PowerShell command history (ConsoleHost_history.txt) with heuristic keyword flagging (IEX, DownloadString, mimikatz, bypass, vssadmin).
  • Windows Explorer RunMRU (Win+R dialog history).
  • UserAssist ROT13-decoded GUI execution records and timestamps.
  • Background Activity Moderator (BAM) forensic records.
• 💾 Staging & Dropper Hunting:
  • Scans %TEMP%, %APPDATA%, and %LOCALAPPDATA% for suspicious binaries (.exe, .dll, .bat, .ps1, .vbs, .js, .scr).
  • Computes cryptographic SHA-256 hashes of staged executables for instant hash lookups.
  • Windows Recent .lnk shortcut activity tracking.
• 📡 Network & USB Footprint:
  • Extracts known Wi-Fi profiles and SSIDs (with dual registry and Netsh fallback).
  • Historical USB drive connections (Vendor, Product ID, Serial number via USBSTOR).
  • Live listening TCP ports and active remote connections with PID association.
• 🔒 Persistence Audit (MITRE T1547.001):
  • Audits HKCU and HKLM Run and RunOnce autostart keys.
  • Inspects User and System Startup directories.
• 🌐 DNS Cache & C2 IoC Hunting:
  • Pulls live resolved DNS entries (ipconfig /displaydns) to detect active Command & Control infrastructure (e.g. ngrok, duckdns, pastebin, discord webhooks).
• 📡 Remote Code Execution & Lateral Movement (MITRE T1021 / T1059):
  • Audits RDP listener status (Port, fDenyTSConnections) and Terminal Services logon sessions (Event ID 21/24/25).
  • PowerShell ScriptBlock Logging (Event 4104) analysis for offensive payloads (IEX, DownloadString, mimikatz, encodedcommand).
• 🏛️ ShimCache (AppCompatCache) Mining:
  • Parses binary Application Compatibility Cache (10ts structure) directly from Windows Registry. Uncovers historical paths of deleted malware executables!
• 📅 Scheduled Tasks Persistence (MITRE T1053.005):
  • Audits Windows Scheduled Tasks (schtasks) to detect suspicious automated triggers running out of %TEMP%, %APPDATA%, or Users\Public.
• 🚨 Windows Event Logs & Anti-Forensics (Event 7045 / 1102 / 104):
  • Uncovers recently installed Windows services and kernel drivers.
  • Detects security audit log purges and anti-forensic tampering.
• 📊 Standalone Interactive Reports:
  • Interactive dark-themed HTML report (Triage_<HOST>_<TIMESTAMP>.html) with zero CDN dependencies (completely offline capable).
  • Normalized structured JSON (Triage_<HOST>_<TIMESTAMP>.json) ready for SIEM ingestion (Splunk, Elastic, Sentinel).

🗺️ MITRE ATT&CK Mapping

📂 Project Architecture

⚡ Quick Start

1. Direct Execution

2. USB Incident Responder Deployment

Copy the OmniTriage folder onto an incident response USB drive. When plugged into a target machine, execute:

Or directly via command-line:

3. Command Line Arguments

🔬 Sample Live Output

⚖️ Legal & Ethical Notice

This software is developed strictly for authorized digital forensics, incident response, system auditing, and educational research. Always obtain proper authorization and consent prior to acquiring artifacts on any computer system.

📄 License

This project is licensed under the MIT License - authored by Çınar (@prox0959).