> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Best Practices

> Tips for effective accdu_inspector triage.

* Use `--dump-markers` during triage to locate hidden VBA signatures.
* Combine with `--extract-from-markers` for auto-recovery of compressed VBA.
* Adjust `--entropy-threshold` when analyzing compressed or obfuscated payloads.
* Review high-entropy `.bin` files manually — often encrypted or packed executables.
* Re-scan carved blobs with external tools (e.g., PEStudio, ExifTool, capa).

## Recommended YARA Sources

* [YARA-Rules/rules](https://github.com/YARA-Rules/rules)
* [Neo23x0/signature-base](https://github.com/Neo23x0/signature-base)
* [Elastic Security Artifacts](https://github.com/elastic/protections-artifacts)
* [abuse.ch Feeds](https://abuse.ch)
* [VirusTotal YARA Repos](https://github.com/VirusTotal/yara)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.