Chimera v1.0 - Initial Release

Chimera v1.0 - Initial Public Release

Chimera is a modular, agent-less forensic triage framework designed for Incident Response teams. It orchestrates proven open-source tools to enable rapid live response and artifact collection on Windows and Linux systems with minimal footprint.

Key Features:

• Cross-platform support: Windows (PowerShell) and Linux (SSH-based)
• Zero persistence on Linux targets: payloads execute in RAM or /tmp with automatic cleanup
• Windows artifact collection via Volume Shadow Copy Service (VSS) to bypass file locks
• Integrated parsing with Eric Zimmerman's EZTools (Amcache, Shimcache, Registry → CSV)
• Browser forensics for Chrome, Edge, and Brave using Hindsight
• Remote memory acquisition with AVML (Microsoft) and on-the-fly Gzip compression

Core Modules:

• Invoke-WinArtifacts
• Invoke-LinuxLiveResponse
• Supporting modules for memory capture, browser parsing, and EZTools integration

Setup:

1. Clone the repository
2. Unblock PowerShell scripts: Unblock-File -Path *.ps1
3. Run ./Initialize-Chimera.ps1 to create the support Tools folder and subfolders
4. Download and place the required external tools (EZTools, AVML, Hindsight) in the Tools/ directory
5. Run ./Chimera.ps1 to launch

Part of the RootGuard ecosystem. Full documentation available at: https://rootguard.gitbook.io/cyberops

MIT licensed • Use responsibly in authorised environments only.