Best Practices

Tips for effective accdu_inspector triage.

• Use --dump-markers during triage to locate hidden VBA signatures.
• Combine with --extract-from-markers for auto-recovery of compressed VBA.
• Adjust --entropy-threshold when analyzing compressed or obfuscated payloads.
• Review high-entropy .bin files manually — often encrypted or packed executables.
• Re-scan carved blobs with external tools (e.g., PEStudio, ExifTool, capa).

Recommended YARA Sources

• YARA-Rules/rules
• Neo23x0/signature-base
• Elastic Security Artifacts
• abuse.ch Feeds
• VirusTotal YARA Repos