SIgma – Baker Street Forensics

2025 Year in Review: Open Source DFIR Tools and Malware Analysis Projects

DFIR, Forensics, Mac, Malware, MITRE ATT&CK, PowerShell, Python, Raspberry Pi, Rust, SIgma, Triage, USB, yara

As 2025 draws to a close, I’m taking a moment to reflect on what turned out to be one of my most productive years in code. From major releases to entirely new projects, this year saw significant evolution across my DFIR toolkit—driven by real-world incident response needs, classroom teaching experiences, and late-night tinkering sessions fueled by good bourbon and better puzzles.

What started as continuing work on CyberPipe evolved into a year of substantial innovation: creating MalChela for YARA and malware analysis, building a portable Raspberry Pi forensics platform, developing automated timeline generation workflows, and crafting specialized utilities that solve specific problems I encountered in the field. Each tool represents not just lines of code, but practical solutions to challenges that digital forensics and incident response professionals face daily.

Whether you’re a seasoned forensic analyst, an incident responder building your toolkit, or a student just getting started in DFIR, my hope is that these open-source projects make your work a little easier and a lot more efficient. All tools remain freely available on GitHub, because I believe the best way to advance our field is to share knowledge and capabilities openly.

Here’s what kept me busy in 2025:

MalChela – YARA & Malware Analysis Toolkit (Rust)

My flagship project that evolved significantly throughout 2025:

March: Initial release – Combined 10 programs into one Rust workspace for YARA and malware analysis
May: v2.1 – Added smoother workflows, better third-party tool integration, and enhanced argument handling
May: v2.2 “REMnux Release” – Native support for REMnux, integrations with Volatility3, Tshark, YARA-X
June: v3.0 – Major update introducing Case Management system, FileMiner (replacing MismatchMiner), and tool suggestion capabilities based on file characteristics
July: v3.0.1 – Refinements to mStrings, improved MITRE mappings, “Select All” functionality, optimizations for running on Toby
August: v3.0.2 – Enhanced threat hunting with MITRE ATT&CK technique lookup

MalChela at a Glance

Rust-based malware analysis toolkit combining YARA scanning, file analysis, hash generation, string extraction with MITRE ATT&CK mapping, and automated malware sample extraction from password-protected archives
Multiple specialized utilities including mzhash/xmzhash for corpus generation, file type mismatch detection, entropy analysis, PE structure examination, and fuzzy hashing capabilities
Integrated threat intelligence with VirusTotal and Malware Bazaar API support, NSRL database queries for known-good file filtering, and Sigma rule application for IOC identification
Case management system (v3.0) featuring unified tracking of files, tools, and notes in case.yaml format with auto-saved outputs, tagging, search functionality, and VS Code integration
Extensible architecture supporting custom tool integration via tools.yamlconfiguration, enhanced support for Volatility 3, TShark, and YARA-X, with both GUI and CLI modes (WSL2-compatible on Windows)
Complete documentation embedded as PDF or online

MalChela v3.0: Case Management, FileMiner, and Smarter Triage

https://github.com/dwmetz/MalChela

CyberPipe – Incident Response Collection Tool (PowerShell)

Continued evolution of the enterprise digital evidence collection script:

May: v5.1 – Streamlined profiles with better flexibility, customizable collection profiles
October: v5.2 – Improved collection methods with dual disk space validation, SHA-256 hashing of artifacts, single-file reporting, network collection simplification
November: v5.3 – Critical PowerShell 5.1 compatibility fixes, dual validation logic, enhanced reliability across all PowerShell environments

CyberPipe v5.3: Enhanced PowerShell Compatibility and Reliability

https://github.com/dwmetz/CyberPipe

CyberPipe-Timeliner ✱New✱ (PowerShell)

November: CyberPipe-Timeliner – New companion project to CyberPipe that automates the workflow from Magnet Response collections to unified forensic timelines using Eric Zimmerman’s EZ Tools and ForensicTimeliner

CyberPipe-Timeliner: From Collection to Timeline in One Script

https://github.com/dwmetz/CyberPipe-Timeliner

Toby – Portable Raspberry Pi Forensics Toolkit

July: Released Toby – A compact forensics toolkit built on Raspberry Pi Zero 2 W running customized Kali Linux, designed for headless operation via SSH/VNC, perfect for field analysis and malware triage

Portable Forensics with Toby: A Raspberry Pi Toolkit

Toby-Find

July: Toby-Find – Terminal-based command-line helper tool for discovering CLI forensics tools in KALI and REMnux environments, created initially for university teaching

Toby-Find: Simplifying Command-Line Forensics Tools

https://github.com/dwmetz/Toby

Crabwise – USB Device Benchmark Utility (Rust)

August: Released Crabwise – A lightweight USB benchmarking tool that measures true read/write speeds of USB devices for forensic workflows. Tests write throughput with pseudo-random data and read performance under uncached conditions. Includes logging functionality to track performance across different cables, hubs, and connection paths, helping forensic investigators optimize their hardware setups.

Is your USB device slowing down your forensic investigation?

https://github.com/dwmetz/Crabwise

Toolbox Utilities – Specialized Python and Bash Scripts

Standalone tools maintained in the Toolbox repository:

October: CoreBreaker.py – Breaks large yara-rules-core files into smaller .yar files for tool ingestion
October: EtTu.py – Caesar cipher brute force decoder (created for Murdle puzzle solving); After all, All work and no play makes Jack a dull boy.
November: cloudtrail_timeline.py – Parses AWS CloudTrail JSON logs and outputs CSV format for Timeline Explorer
November: mac_triage_timeline.sh – Processes Mac-Triage ZIP files and generates timeline for Timeline Explorer
November: uac_timeline.sh – Processes UAC tar.gz files and generates timeline for Timeline Explorer (Linux/macOS)

https://github.com/dwmetz/Toolbox

All projects are available on my GitHub at github.com/dwmetz, with detailed documentation on bakerstreetforensics.com. My goal is making DFIR and malware analysis more accessible, automated, and efficient for incident responders and forensic analysts.

MalChela GUI: Visualizing Malware Analysis with Ease

DFIR, hashing, Malware, Rust, SIgma, Triage, yara

A New Face for MalChela

MalChela, a Rust based toolkit for YARA and malware analysis, was released as a set of command-line apps just a few months ago. Now, it steps into a new realm with the introduction of a graphical user interface (GUI), bringing its powerful features to a broader audience.

The transition from command-line to GUI isn’t just a cosmetic upgrade; it’s a strategic move to make malware analysis more accessible. The GUI version retains all the robust functionalities of its predecessor while offering an intuitive interface that caters to both seasoned analysts and newcomers.

Key Features at a Glance

File Analyzer Module

The updated fileanalyzer module provides a comprehensive overview of suspect files. By simply providing the path to a file, users receive:

SHA-256 Hash,
Entropy analysis,
Regular expression detection for packing,
PE header information (for PE files),
File metadata,
Suspicious API calls,
YARA rule matches (against your local library)
and VirusTotal hash matches.

This module serves as an excellent first step in static analysis, offering a detailed snapshot of the file’s characteristics.

mStrings Integration

One of MalChela’s standout features, mstrings, is seamlessly integrated into the GUI. This function extracts strings from files and applies Sigma rules defined in YAML to evaluate threats, aligning results with the MITRE ATT&CK framework. It’s a powerful tool for identifying indicators of compromise (IOCs) and understanding malware behavior. Users of MalChela can easily customize their own detection rules in YAML. About 15 new detection rules were added in this release.

Other Tools in the MalChela Suite

Beyond mstrings and fileanalyzer, the MalChela suite includes a range of focused utilities designed to support malware triage and forensic workflows.

malhash lets you quickly query both Virus Total and Malware Bazaar via API calls. The GUI includes an API configuration utility. The CLI will walk you through it.

mismatchminer walks a directory or volume looking for executables disguised as other file types.

mzmd5 and xmzmd5 generate MD5 hash sets—useful for building known-good or known-bad reference hash sets for matching against large corpora.

mzcount provides a quick census of file types in a directory.

strings_to_yara lets you transform suspicious strings into functional YARA rules.

extract_samples recursively unpacks directories of password protected archives often used in malware distribution.

nsrlquery lets you quickly check a hash against the CIRCL hash database.

MalChela’s modular approach with support for custom rule generation, gives analysts what they need without unnecessary overhead. Each tool is designed to run independently but plays well within the broader GUI ecosystem.

Output for any included tool can be saved or skipped at runtime with a simple toggle in the GUI. Structured tools support exporting results in plain text and JSON formats, while YARA rule creation and notes can also be saved in YAML or Markdown.

The Scratchpad:

Notes, YARA Strings, and Analyst Flow

Analysis often involves scattered notes, pasted IOCs, potential YARA strings, and fleeting insights. The MalChela GUI brings structure to that chaos with a built-in scratchpad — a minimalist text editor embedded directly in the interface.

The scratchpad supports live note-taking during tool runs, temporary storage of strings for strings_to_yara, manual IOC tracking and observation logging, and a copy/paste buffer for hashes, commands, or decoded payloads.

Auto-Save & Formats

By default, the scratchpad auto-saves your content every 10 seconds to prevent loss during intense analysis sessions. A simple dropdown lets you export your notes in .txt, .yaml, or .md formats—ideal for integrating with reports or detection development pipelines.

VS Code Integration

For those who prefer a full-featured editor, the “Open in VS Code” button sends your current note directly to a VS Code window, assuming it’s installed and on your system path. This bridges the gap between in-tool triage and deeper rule crafting or documentation workflows.

Bonus Tip: strings_to_yara Compatibility

Lines in the scratchpad that begin with hash: are ignored by the strings_to_yara tool. This allows analysts to keep reference hashes or tagging metadata in the same document without interfering with rule generation. You can import your scratchpad into strings_to_yara in one click.

This feature isn’t just a notepad—it’s a tactical workspace. Whether you’re building detections, jotting notes mid-investigation, or scripting quick ideas, the scratchpad keeps yourn workflow grounded and your thoughts collected.

Last but not least, a crab with karma

Update Checker

The GUI includes a function to automatically check the GitHub repository for updates, encouraging users to pull the latest changes and ensure they have the most current tools at their disposal. 🦀

Enhancing the Analysis Workflow

The GUI version of MalChela doesn’t just replicate CLI functionalities; it enhances the overall workflow. The visual interface allows for easier navigation between modules, quick access to results, and a more streamlined analysis process.

For instance, after walking a directory with mismatchminer you find a suspect file. You run fileanalyzer and can directly proceed to mstrings if the initial findings warrant deeper investigation. From there VirusTotal and Malware Bazaar information can be queried with malhash. Drop your notes in the scratchpad as you go and then use strings_to_yara to draft a YARA rule without worrying about a single tab or indent.

But wait, there’s more

Integrating Third-Party Tools with YAML

The MalChela GUI supports third-party tool integration using a simple tools.yaml configuration file. This makes MalChela not just a toolkit, but a flexible launchpad for your broader forensic workflow.

Each entry in tools.yaml defines the command, input type, and category for a tool. MalChela parses this file at startup, populating the GUI dynamically. Analysts can add their own utilities—whether it’s a custom script, a Python tool, or an external binary—without needing to recompile the application.

- name: Extract Samples
  command: ["extract_samples"]
  input_type: folder
  category: "Utilities"
- name: File Analyzer
  command: ["fileanalyzer"]
  input_type: file
  category: "File Analysis"
# Example 3rd party integration:
# Below is a disabled example for capa
# Uncomment to enable if capa is in your PATH
#
# - name: capa
#   command: "capa"
#   input_type: "file"
#   category: "External"
#   optional_args: []

Once added, the tool appears in the GUI under its specified category, ready to be launched with a single click. Tools must be available in the system PATH, and input types must be one of: file, folder, or hash.

This keeps the interface clean, configurable, and analyst-driven—allowing teams to tailor MalChela to fit their exact needs without touching a single line of Rust.

MalChela is built with the belief that collaboration fuels innovation. I welcome contributions from the broader security and forensics community—whether it’s crafting new detection logic, enhancing YARA rule coverage, refining the GUI, or integrating additional tools via YAML. If you have an idea, patch, or workflow improvement, I’d love to see it. Together, we can make MalChela a more powerful and adaptable tool for every analyst.

Getting Started

👉 MalChela on GitHub

To explore the GUI version of MalChela, visit the official GitHub repository:

Installation instructions and a user guide are available to help you get started. Whether you’re a seasoned analyst or just beginning your journey in malware analysis, the GUI version of MalChela offers a user-friendly yet powerful tool to aid your investigations.

MalChela GUI runs on Mac and Linux (with extra love for Mac users). For use on Windows the entire MalChela CLI toolset is supported under WSL 2.

MalChela Updates: New Features and Enhancements

DFIR, Forensics, hashing, Malware, Rust, SIgma, Triage, yara

It’s been just over a week since MalChela was initially released and already here have been a number of updates.

mStrings

In the previous post, I walked through the new mStrings function. I think this is one of my favorites so far. It extracts strings from a file and uses Sigma rules defined in YAML against the strings to evaluate threats and align results to the MITRE ATT&CK framework.

For fun I pointed it at an old WannaCry sample . I had a proud papa moment at the positive network IOC detection.

Check for Updates

Next came a function to automatically check the GitHub repo for updates and encourage a git pull to grab the latest… because apparently I can’t stop myself and this project will just keep growing, as my sleep keeps dwindling. Personally I found it ironic that you have to update in order to get the update telling you that updates are available… but it will work for all future updates as they come. So go ahead and update why don’t you.

*Screenshot of MalChela indicating an update is available via git.*

New File Analyzer module

Most recently a File Analyzer module has been added. Give it the path to your suspect file and it will return back:

SHA-256 Hash
Entropy (<7.5=high)
A RegEx detection for packing (mileage may vary)
PE Header info if it’s a PE
File Metadata
Yara Matches (any rules in yara_rules folder in workspace)
If there’s a positive match for the hash on VirusTotal (leverages the same key as previously in MalChela with the Virus Total / Malware Bazaar lookup)

Lastly, you’re given the option of whether or not you want to run strings on the file, or return to the main menu.

I really like the idea of using this as a possible first step in static analysis. Run this first and opt for strings. Things look interesting there, throw it into mStrings. Positive match on VirusTotal – use the malware hash lookup and get a more detailed analysis. Use the results from mStrings to craft a YARA rule and add it to your repo for future detections.

mStrings: A Practical Approach to Malware String Analysis

DFIR, Forensics, hashing, Malware, Rust, SIgma, Triage, yara

String analysis is a cornerstone of malware investigation, revealing embedded commands, URLs, and other artifacts that can expose a threat’s intent. mStrings, a Rust-based tool, simplifies this process by scanning files, extracting meaningful strings, and structuring results for efficient analysis.

At its core, mStrings is more than a simple string extraction tool. It integrates regex-based detection rules to identify key indicators, offering a refined approach to analyzing malware artifacts. In addition to console output it also presents data in a structured JSON format, allowing for seamless integration into other security workflows.

In addition to specialized string searching, mStrings detections associate results with MITRE ATT&CK. When malware indicators map to known MITRE ATT&CK techniques, analysts can quickly understand the intent and behavior of a threat. Instead of just seeing a suspicious string, they can recognize that it corresponds to credential dumping, command-and-control, or privilege escalation, enabling faster triage and response.

Optimized for Practical Investigation

Security professionals often need to cross-reference findings in a hex editor. mStrings accounts for this by capturing detailed string locations in hex, allowing for immediate context when reviewing suspicious files. This level of granularity is particularly valuable when analyzing packed or obfuscated malware, where offsets can provide crucial insights.

*mStrings showing hex location for identified string*

After the scan, reviewing the complete strings dump is just as easy with an option to open the results directly in VS Code.

*mStrings prompt to review saved strings*

Technology That Powers It

Built in Rust, mStrings leverages its robust ecosystem to enhance performance and reliability. Sigma-based detection rules allow for flexible and easily modifiable patterns, giving analysts control over what indicators to track. The tool’s structured approach ensures that results are not just extracted but meaningfully categorized for deeper analysis.

A Tool That Grows with You

mStrings is extensible, enabling you to customize detections. Not satisfied with the existing detection rules? You can easily write your own in Sigma. Future improvements will refine regex patterns, enhance Windows compatibility, and introduce new features to improve investigative workflows. Designed with usability in mind, mStrings serves as a practical companion for analysts who need clear, structured, and insightful data extraction.

MStrings is one of many malware analysis utilities included in MalChela. Download from Github and let me know what you think. If you’ve already installed Malchela, git pull will download the latest updates.

https://github.com/dwmetz/MalChela

Try this out for a workflow. Use Hash It (3) and give it the file path for a malware file. Use the hash from Hash It and check it against VirusTotal an Malware Bazaar with the Malware Hash Lookup (10). Then jump into mStrings (4), give it the same file path again, and start pulling out the interesting strings. Once you have what you think is a good number of indicators, run Strings to YARA (9) and generate a fully formatted YARA rule for use in any of your security tools.