CyberChef: a recipe is a chain you can hand to someone else

Input, operations, output

CyberChef is a local workbench. You paste or open bytes, you stack operations, and you bake. Each operation has a name you can read: From Base64, From Hex, URL Decode, Strings. The stack is a recipe. The same recipe on the same input produces the same output, which is why it belongs in a case file and not only on the screen. Magic, the wand, will guess a first operation. Treat a guess as a candidate. You still look at the output and decide whether it is the format you expected.

The bytes have to already be in the case. A command-line argument from the Volatility note, a cell in the Sysmon CSV, a small file in the export folder. CyberChef is not a place you go to fetch new evidence from the network. If the input is a hash or a short token, say where you copied it from, including the plugin or the event id, so a reader can find the same bytes without your browser history.

Order is the recipe

Operations run from top to bottom. From Base64 and then Strings is a different recipe from Strings and then From Base64. When a decode fails, the failure is information: wrong operation, wrong slice of the file, or bytes that were never that encoding. Do not stack five speculative decodes and keep the one output that contains a readable English word. That is how you manufacture a story. Keep a step only when you can say what it corresponds to in the artifact, such as “the command line used Base64, so the first operation is From Base64.”

Disable an operation rather than deleting it when you are still comparing. The disabled step stays visible in the recipe you save, which is a record of what you tried. When you are done, the saved recipe for the report should contain the steps you actually rely on, and the case log can mention the dead ends in a sentence. A recipe with twelve disabled experiments is a lab notebook. The report wants the short chain.

Save the input next to the recipe

Export the recipe and also save the exact input bytes. A recipe without input cannot be rerun. An output without the recipe cannot be explained. Name them with the case and the source: NL-2026-041-cmdline-input.txt, NL-2026-041-cmdline-recipe.json, NL-2026-041-cmdline-output.txt. Hash the output if it becomes an exhibit of its own, and point the hash back at the input hash. Derivatives again: the memory image and the Sysmon log remain the originals.

If the output is text, read it before you paste it into the report. A decoded command that names the two workbook paths is case text and belongs in the note. A decoded blob that turns out to be an unrelated cache is a negative and belongs in the log as a negative. Either way you keep the files so the read can be repeated.

• Source of the input: plugin, event, or path.
• The recipe file.
• The output file, hashed if you will cite it.
• One sentence on whether the output matched the format you expected.

Keep the work on the case machine

The payroll names are confidential. Use a copy of CyberChef you run locally, on the examiner machine, so the bytes are not pasted into a third-party website. The project publishes a page you can save and open from disk. The case log should say you used a local copy. If the lab only has the public site and the data is synthetic, say that too. NL-2026-041’s real workbook would not go to a remote page even if the recipe is convenient.

Then write the chain in the report as prose and as a file. “From Base64 on the argument extracted in cmdline-4812.txt produced a short file-copy command naming both workbook paths.” A reader who never opens CyberChef can still see the claim, and a reader who has it can rerun the recipe.

Worked case: the argument from pid 4812

The command-line extract contains a Base64 field you already copied into cmdline-4812-b64.txt. You open a local CyberChef, set that file as input, and add From Base64. The output is a short PowerShell statement that copies Documents\Payroll-April.xlsx to %TEMP%\p4.xlsx. You save the recipe and the output, hash the output, and label it content, consistent with the YARA label on the same extract.

You do not add a second decode. The output is already the text the command line was carrying. The case log gains one line: “local CyberChef, From Base64, output names both paths, no further operation.” The upload question is still the Sysmon and netscan question. The recipe answered what the argument said.