AppCompatProcessor
#Threat Defense#Threat Management
Scan files or process memory for Cobalt Strike beacons and parse their configuration.
AppCompatProcessor: Enhancing Data Extraction Capabilities
AppCompatProcessor is specifically designed to extract greater value from enterprise-wide AppCompat / AmCache data. This approach goes beyond traditional methods such as stacking and grepping, allowing for more comprehensive data analysis.
Installation Instructions
OSX:
To install, you need Python 2.7 or higher, as well as libregf and pyregf (Python bindings) from https://github.com/libyal/libregf.
- Option A: Using the source distribution package
1. Download the source distribution package from https://github.com/libyal/libregf/releases.
2. Run the following commands:
./configure --enable-python && make
sudo make install
python setup.py build
python setup.py install
- Option B: Cloning directly from source
1. Clone the repository using Git:
git clone https://github.com/libyal/libregf.git
2. Navigate into the cloned directory:
cd libregf/
3. Synchronize libraries and prepare for installation:
./synclibs.sh
./autogen.sh
./configure --enable-python && make
sudo make install
python setup.py build
python setup.py install
Additional Requirements for Setup
You can fulfill the remaining requirements by using the command 'pip install -r requirements.txt'.
Linux:
Make sure you have Python version 2.7 or higher installed. Running 'sudo pip install -r requirements.txt' should address all your installation needs.
If you encounter any issues related to libregf or other dependencies, please refer to the documentation for troubleshooting steps.
