Our core incident response tool Kraken can be used to collect host evidence from Windows machines for threat hunting and further analysis.