CyberChef

CyberChef is a web-based tool for encrypting, encoding, decoding, and analyzing data. Known as the "Cyber Swiss Army Knife," it helps you carry out simple and complex data manipulation tasks in Sophos XDR, such as the following:

• Decode encoded data, such as base64 or XOR.
• Perform data conversions, including time zone conversions.
• Decrypt and disassemble shellcode.
• Compress and decompress data.
• Calculate hashes and checksums.

You can also create and save recipes for later use. For more details and examples of what the tool can do, see the CyberChef documentation.

CyberChef in Sophos XDR

You can open CyberChef from case details pages by clicking the CyberChef icon in the right sidebar.

Using CyberChef

Here is an example of how to use CyberChef to decode base64 data.

1. Open CyberChef from a case details page.
2. Drag the From Base64 operation from the Operations section to the Recipe section.
3. Paste your encoded data into the Input section.
4. The recipe decodes the data and shows it in the Output section.