forensicnomicon

Forensicnomicon is a DFIR (Digital Forensics and Incident Response) knowledge-as-code project from SecurityRonin. It compiles forensic knowledge into a zero-dependency Rust library and an offline CLI (`4n6query`), enabling millisecond queries without a browser or network connection. **Core capabilities:** - **Artifact catalog:** 6,554 forensic artifacts across Windows, Linux, macOS, and cloud environments. Entries include decoded field schemas, analyst-written meanings, triage priorities, evidence strength ratings, and detection pivots. Sources include KAPE targets, ForensicArtifacts YAML, EVTX/ETW channels, Velociraptor artifacts, and more. - **Unified LOL/LOFL lookup:** Six datasets (LOLBAS, GTFOBins, LOOBins, LOFL cmdlets, MMC snap-ins, WMI classes) combined into one API, covering Windows, Linux, and macOS binaries. - **Abusable sites:** Maps domains used for C2, phishing, and payload delivery, with blocking-risk assessments. - **Indicator tables:** Ports, processes, commands, paths, persistence, antiforensics, remote access, and third-party application indicators. - **Enrichment modules:** MITRE ATT&CK flow, Sigma rules, YARA templates, KAPE/Velociraptor mappings, Chainsaw rules, STIX mappings, and temporal hints. - **Normalized reporting (`report`):** A shared finding vocabulary for all SecurityRonin analyzers, with severity levels, categories, and evidence-based observations. - **State-history (`history`):** Time-indexed navigation primitives for disk, memory, and log artifacts, with temporal profiles per source family. **CLI usage examples:** ```bash 4n6query certutil.exe # LOLBin lookup 4n6query userassist # Artifact search 4n6query T1547.001 # MITRE technique lookup 4n6query --triage # Critical artifacts first 4n6query dump --format json # Full dataset export ``` **Library usage:** Add `forensicnomicon = "1"` as a dependency for the full catalog, or use `forensicnomicon-core` for a stable engine with `forensicnomicon-data` for the knowledge base. **Used by:** SecurityRonin's forensic analyzer fleet (vmdk-forensic, winevt-forensic, memory-forensic, etc.), the `issen` triage tool, and `blazehash`. Licensed under Apache-2.0, requiring Rust 1.75+.