CyLR triage

CyLR.exe -od <output>

Collects Windows host forensic artifacts with CyLR, the triage collector that packages IR data into a zip.

Run it when you need host triage collection: CyLR gathers key system artifacts — registry hives, EVTX, prefetch, LNK, configuration files, system information — and packages them into a zip with an organized structure. It's the go-to triage collector: run it, take the zip, and analysis happens in the lab (or upload to the SIEM). In IR, CyLR is the first step in collecting from a suspicious host: artifacts in a single file, without installing anything on the compromised host.

Don't use it as a complete collection: CyLR gathers the main Windows artifacts — application-specific ones (logs of a particular app, files of a service) are added via configuration or separately. Collection on a compromised host alters the system (accessing artifacts updates timestamps): the IR order (capture volatile first, then artifacts) must be respected. And note: CyLR runs on the host — in a compromise with an active actor, execution is visible; memory and network capture take priority over triage. For collection at scale, use KAPE or Velociraptor; CyLR is the point-in-time host collector.