Windows 11 Notepad (TabState) and CertUtil parsers.

Modules/Apps/GitHub/CertUtil_Parser.mkape

@@ -0,0 +1,18 @@
+Description: A Module to parse Certutil activity
+Category: Windows
+Author: DReneau
+Version: 1.0
+Id: 7d18d1ad-13b5-435c-a5f1-063093e39646
+BinaryUrl: https://github.com/AbdulRhmanAlfaifi/CryptnetURLCacheParser/releases/tag/1.1/CryptnetUrlCacheParser.exe
+ExportFormat: csv
+Processors:
+  - Executable: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
+    CommandLine: "& \"%kapeDirectory%\\Modules\\bin\\CryptnetUrlCacheParser.exe\" -o \"%destinationDirectory%\\Certutil_Parsed.csv\""
+    ExportFormat: csv
+
+# Documentation
+# https://u0041.co/posts/articals/certutil-artifacts-analysis/
+# https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
+# https://thinkdfir.com/2020/07/30/certutil-download-artefacts/
+# Certutil is a Windows utility used by threat actors to download arbitrary files/tools using Land Binary (LOLBin)  techniques.
+# Certutil can also be used to base64 encode/decode and calculate file hashes.

Modules/Apps/GitHub/Notepad_Parser.mkape

@@ -0,0 +1,18 @@
+Description: A Module to parse (Windows 11+) Notepad TabState files.
+Category: Windows
+Author: DReneau
+Version: 1.0
+Id: b5a8a229-4897-4bda-a8f0-f2246362664f
+BinaryUrl: https://github.com/AbdulRhmanAlfaifi/notepad_parser/releases/download/v0.1.0/notepad_parser.exe
+ExportFormat: json
+Processors:
+  - Executable: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
+    CommandLine: "Get-ChildItem -Recurse '%sourceDirectory%' -Filter '*.bin' | Where-Object { $_.FullName -like '*Microsoft.WindowsNotepad_8wekyb3d8bbwe\\LocalState\\TabState*' } | ForEach-Object { $outputFile = Join-Path '%destinationDirectory%' ([System.IO.Path]::GetFileNameWithoutExtension($_.FullName) + '.json'); $tempFile = Join-Path '%destinationDirectory%' ([System.IO.Path]::GetFileNameWithoutExtension($_.FullName) + '_temp.json'); & '%kapeDirectory%\\Modules\\bin\\notepad_parser.exe' \"$($_.FullName)\" -f jsonl -o $tempFile; if (Test-Path $outputFile) { Remove-Item $outputFile }; Rename-Item $tempFile $outputFile }"
+    ExportFormat: json
+
+# Documentation
+# https://u0041.co/posts/articals/exploring-windows-artifacts-notepad-files/
+# Windows 11 Notepad stores a cache of recently opened files. This cache contains valuable information, such as file paths, file contents, and other useful data.
+# This parser written by AbdulRhman Alfaifi will parse the Windows 11 Notepad cache, specifically the TabState.
+# The Notepad artifacts are stored here: "%LOCALAPPDATA%\Packages\Microsoft.WindowsNotepad _8wekyb3d8bbwe\LocalState"
+