List of all items

Structs

• abusable_sites::AbusableSite
• antiforensics_aware::AntiForensicRisk
• antiforensics_aware::ArtifactAntiForensics
• artifact::ArtifactDescriptor
• artifact::ArtifactParsingProfile
• artifact::ArtifactQuery
• artifact::ArtifactRecord
• artifact::BinaryField
• artifact::ContainerProfile
• artifact::ContainerSignature
• artifact::FieldSchema
• artifact::ForensicCatalog
• artifact::PlatformMask
• artifact::RecordSignature
• artifact::types::ArtifactDescriptor
• artifact::types::ArtifactParsingProfile
• artifact::types::ArtifactQuery
• artifact::types::ArtifactRecord
• artifact::types::BinaryField
• artifact::types::ContainerProfile
• artifact::types::ContainerSignature
• artifact::types::FieldSchema
• artifact::types::ForensicCatalog
• artifact::types::PlatformMask
• artifact::types::RecordSignature
• attack_events::NativeEventTechnique
• attack_flow::AttackFlow
• attack_flow::FlowAction
• beaconing::BeaconAssessment
• beaconing::BeaconingThresholds
• boot_signatures::BootCodeSignature
• bootkit::BootkitMarker
• bootkit::StashSector
• browser_profiles::ContainerApp
• browser_profiles::ProfileMarker
• catalog::ArtifactDescriptor
• catalog::ArtifactParsingProfile
• catalog::ArtifactQuery
• catalog::ArtifactRecord
• catalog::BinaryField
• catalog::ContainerProfile
• catalog::ContainerSignature
• catalog::FieldSchema
• catalog::ForensicCatalog
• catalog::PlatformMask
• catalog::RecordSignature
• catalog::types::ArtifactDescriptor
• catalog::types::ArtifactParsingProfile
• catalog::types::ArtifactQuery
• catalog::types::ArtifactRecord
• catalog::types::BinaryField
• catalog::types::ContainerProfile
• catalog::types::ContainerSignature
• catalog::types::FieldSchema
• catalog::types::ForensicCatalog
• catalog::types::PlatformMask
• catalog::types::RecordSignature
• chainsaw::HuntRuleRef
• decmpfs::Compression
• dependencies::ArtifactDependency
• dmg::KolyTrailerOffsets
• dpapi::CipherAlgInfo
• dpapi::HashAlgInfo
• drivers::VulnerableDriver
• eol_os::EolOs
• eventids::EventIdEntry
• evtx::DefenderEvent
• evtx::EvtxChunkHeaderOffsets
• evtx::EvtxFileHeaderOffsets
• evtx::LateralMovementEvent
• evtx::ProcessExecution
• evtx::RdpSessionEvent
• evtx::ScheduledTask
• evtx::SmbAccessEvent
• evtx::WmiEvent
• filesystems::FsSignature
• forensicartifacts::ForensicArtifactsRef
• gpt::GptType
• handbook::Handbook
• heuristics::linux_rootkit::ElfStringPattern
• heuristics::linux_rootkit::HookSymbol
• heuristics::pe::CoffHeader
• heuristics::pe::SectionEntry
• history::clock::ClockProvenance
• history::cohort::IdentityDiscontinuity
• history::cohort::TemporalCohort
• history::cohort::TemporalState
• history::cohort::Timestamp
• history::cohort::Tombstone
• history::epoch::EpochTag
• history::identity::ArtifactRef
• history::identity::CohortKey
• history::profiles::SourceTemporalProfile
• history::source::CohortQuery
• history::source::Evidence
• history::source::WorkingCopy
• lolbins::LolbasEntry
• mitre::AttackTechnique
• partition_types::MbrPartitionType
• playbooks::InvestigationPath
• playbooks::InvestigationStep
• plugin::ExtendedCatalog
• qcow2::Qcow2HeaderOffsets
• references::ModuleReference
• report::Confidence
• report::Evidence
• report::ExternalRef
• report::Finding
• report::FindingBuilder
• report::FindingContext
• report::Provenance
• report::Report
• report::Source
• report::SubjectRef
• report::TimelineEvent
• report::Timestamp
• sigma::SigmaRef
• stix::StixMapping
• temporal::TemporalHint
• temporal_formats::TimeFormat
• threat_intel::engine::DetectedSignal
• threat_intel::profile::FiredSignal
• threat_intel::profile::MalwareProfile
• threat_intel::profile::ProfileMatch
• threat_intel::profile::ProfileSignal
• threat_intel::profile::WeightedExclusion
• threat_intel::signals::SignalMeta
• timelining::BodyfileField
• timelining::PlasoParser
• timelining::TimelineTool
• timestamp_artifacts::ArtifactTimestamp
• toolchain::KapeMapping
• version_history::ArtifactVersionHistory
• version_history::VersionChange
• vhd::VhdFooterOffsets
• vmdk::CowdHeaderOffsets
• vmdk::GrainMarkerOffsets
• vmdk::SeSparseHeaderOffsets
• vmdk::Vmdk4HeaderOffsets

Enums

• abusable_sites::BlockingRisk
• abusable_sites::SiteCategory
• antiforensics_aware::AntiForensicTechnique
• artifact::ArtifactLocation
• artifact::ArtifactValue
• artifact::BinaryFieldType
• artifact::DataScope
• artifact::DecodeError
• artifact::Decoder
• artifact::HiveTarget
• artifact::OsScope
• artifact::Platform
• artifact::TriagePriority
• artifact::ValueType
• artifact::types::ArtifactLocation
• artifact::types::ArtifactValue
• artifact::types::BinaryFieldType
• artifact::types::DataScope
• artifact::types::DecodeError
• artifact::types::Decoder
• artifact::types::HiveTarget
• artifact::types::OsScope
• artifact::types::Platform
• artifact::types::TriagePriority
• artifact::types::ValueType
• browser_profiles::AppKind
• browser_profiles::MarkerKind
• cadet::ActivityCategory
• catalog::ArtifactLocation
• catalog::ArtifactValue
• catalog::BinaryFieldType
• catalog::DataScope
• catalog::DecodeError
• catalog::Decoder
• catalog::HiveTarget
• catalog::OsScope
• catalog::Platform
• catalog::TriagePriority
• catalog::ValueType
• catalog::types::ArtifactLocation
• catalog::types::ArtifactValue
• catalog::types::BinaryFieldType
• catalog::types::DataScope
• catalog::types::DecodeError
• catalog::types::Decoder
• catalog::types::HiveTarget
• catalog::types::OsScope
• catalog::types::Platform
• catalog::types::TriagePriority
• catalog::types::ValueType
• chainsaw::HuntTool
• cloud_ranges::CloudProvider
• decmpfs::Algorithm
• decmpfs::Storage
• dependencies::DependencyKind
• drivers::DriverCategory
• evidence::EvidenceStrength
• evtx::EvtxEvent
• heuristics::pe::OptionalHeaderMagic
• history::clock::AuthMechanism
• history::clock::ClockSource
• history::clock::TamperResistance
• history::clock::TrustGrade
• history::epoch::CohortTopology
• history::epoch::LsnKind
• history::epoch::MaterializationSafety
• history::epoch::PruneTrigger
• history::epoch::TopologyKind
• history::identity::HashAlgo
• history::identity::IdentityClaim
• history::identity::IdentityDiscipline
• history::profiles::OrderingBasis
• jumplist::CategoryType
• jumplist::KnownCategory
• olecf::Color
• olecf::ObjectType
• partition_schemes::Scheme
• peripheral::Bus
• processes::SpoofConfidence
• report::Category
• report::Location
• report::Severity
• shell_history::Shell
• stix::StixObservableType
• temporal::TemporalRelation
• temporal_formats::Encoding
• temporal_formats::LeapSemantics
• temporal_formats::PackedLayout
• temporal_formats::TzSemantics
• temporal_formats::Unit
• threat_intel::profile::Classification
• threat_intel::profile::MalwareClass
• timelining::TimelineOutputFormat
• version_history::ChangeType
• volatility::VolatilityClass

Traits

• cadet::ArtifactDescriptorCadetExt
• history::source::AcquisitionProtocol
• history::source::HistoricalSource
• history::source::StateMaterializer
• plugin::CustomDecoder
• report::Observation

Functions

• abusable_sites::abusable_site_info
• abusable_sites::is_abusable_site
• abusable_sites::sites_above_risk
• abusable_sites::sites_with_tag
• antiforensics::is_known_rootkit
• antiforensics::is_log_wipe_command
• antiforensics::is_secure_delete_tool
• antiforensics::is_shadow_copy_deletion_command
• antiforensics::is_timestomp_indicator
• antiforensics_aware::anti_forensics_for
• antiforensics_aware::artifacts_vulnerable_to
• apm::is_known_type
• artifact::all_container_profiles
• artifact::all_container_signatures
• artifact::all_parsing_profiles
• artifact::all_record_signatures
• artifact::container_profile
• artifact::container_profile_for_artifact
• artifact::container_signature
• artifact::container_signature_for_artifact
• artifact::parsing_profile
• artifact::record_signatures_for_artifact
• artifact::record_signatures_for_container
• attack_events::technique_for
• attack_flow::all_flows
• attack_flow::artifacts_in_flow
• attack_flow::flow_by_id
• attack_flow::flows_for_artifact
• attack_flow::flows_for_technique
• attack_flow::is_technique_in_known_campaign
• beaconing::assess_periodicity
• boot_signatures::identify_loader
• bootkit::scan
• bootkit::stash_sectors_at
• browser_profiles::attribute_container
• browser_profiles::chromium_profile_markers
• browser_profiles::firefox_profile_markers
• catalog::all_container_profiles
• catalog::all_container_signatures
• catalog::all_parsing_profiles
• catalog::all_record_signatures
• catalog::container_profile
• catalog::container_profile_for_artifact
• catalog::container_signature
• catalog::container_signature_for_artifact
• catalog::parsing_profile
• catalog::record_signatures_for_artifact
• catalog::record_signatures_for_container
• chainsaw::covered_artifact_ids
• chainsaw::hunt_rules_for
• chainsaw::rules_for_tool
• cloud_ranges::classify_ipv4
• commands::is_credential_dumping_command
• commands::is_defense_evasion_command
• commands::is_download_tool_usage
• commands::is_lateral_movement_command
• commands::is_powershell_abuse
• commands::is_recon_command
• commands::is_reverse_shell_pattern
• commands::is_wmi_abuse
• decmpfs::classify
• dependencies::dependencies_of
• dependencies::dependency_graph
• dependencies::dependents_of
• dependencies::full_collection_set
• dpapi::cipher_alg_info
• dpapi::hash_alg_info
• drivers::is_known_vulnerable_driver
• encryption::all_encryption_paths
• encryption::is_encryption_tool_path
• encryption::is_ransomware_extension
• eol_os::is_eol_as_of
• eol_os::lookup
• eventids::event_entry
• eventids::events_for_artifact
• eventids::high_value_events
• evidence::artifacts_with_strength
• evidence::evidence_for
• filesystems::detect_name
• forensicartifacts::fa_ref_for
• forensicartifacts::mapped_artifact_ids
• forensicartifacts::to_fa_yaml
• gpt::attribute_names
• gpt::type_name
• heuristics::entropy::byte_entropy
• heuristics::entropy::is_high_entropy
• heuristics::entropy::is_packed_pe_section
• heuristics::evtx::is_big_three_channel
• heuristics::evtx::is_low_volume_channel
• heuristics::evtx::is_overlooked_channel
• heuristics::evtx::is_rare_source_id_pair
• heuristics::evtx::is_reserved_event_id
• heuristics::is_born_before_install
• heuristics::is_burst_access
• heuristics::is_common_tunnel_port
• heuristics::is_ephemeral_port
• heuristics::is_hollow_file
• heuristics::is_hour_outside_working_hours
• heuristics::is_miner_port
• heuristics::is_null_timestamp
• heuristics::is_potential_container
• heuristics::is_rapid_sequence
• heuristics::is_regular_interval
• heuristics::is_si_before_fn
• heuristics::is_system_uid
• heuristics::is_user_uid
• heuristics::memory::is_canonical_x64
• heuristics::memory::is_kernel_address_x64
• heuristics::memory::is_large_private_region
• heuristics::memory::is_rwx_page
• heuristics::memory::is_shellcode_candidate_size
• heuristics::memory::is_user_address_x64
• heuristics::network::consonant_run_max
• heuristics::network::is_ipv4_mapped_v6
• heuristics::network::is_likely_dga
• heuristics::network::is_link_local_ipv4
• heuristics::network::is_loopback_ipv4
• heuristics::network::is_loopback_ipv6
• heuristics::network::is_multicast_ipv4
• heuristics::network::is_private_ipv4
• heuristics::network::is_private_ipv6
• heuristics::network::is_public_ipv4
• heuristics::network::vowel_ratio_ppt
• heuristics::paths::is_alternate_data_stream
• heuristics::paths::is_double_extension
• heuristics::paths::is_internet_download
• heuristics::paths::is_linux_hidden_name
• heuristics::paths::is_ntuser_man_path
• heuristics::paths::is_pam_exec_script_suspicious
• heuristics::paths::is_pam_module_path_suspicious
• heuristics::paths::is_suspicious_console_subkey
• heuristics::paths::is_suspicious_console_value_name
• heuristics::paths::is_suspicious_exec_path
• heuristics::paths::is_task_com_handler_dll_suspicious
• heuristics::paths::is_unc_path
• heuristics::pe::parse_coff_header
• heuristics::pe::parse_dos_header
• heuristics::pe::parse_optional_header_magic
• heuristics::pe::parse_section_entry
• heuristics::process::has_pid_gap
• heuristics::process::is_child_born_before_parent
• heuristics::process::is_comspec_in_registry_value
• heuristics::process::is_dangerous_capability
• heuristics::process::is_elevated_token
• heuristics::process::is_lateral_movement_logon
• heuristics::process::is_openssh_virtual_users_domain
• heuristics::process::is_remote_logon
• heuristics::process::is_run_key_powershell_stager
• heuristics::process::is_service_binpath_compression_obfuscated
• heuristics::process::is_system_session
• heuristics::process::is_valid_windows_pid
• heuristics::process::is_winscp_ssh_service_logon
• heuristics::scoring::combine_all_confidence
• heuristics::scoring::combine_confidence
• heuristics::scoring::exceeds_threshold
• heuristics::scoring::indicator_score
• heuristics::srum::is_automated_execution
• heuristics::srum::is_background_cpu_dominant
• heuristics::srum::is_beaconing
• heuristics::srum::is_exfil_ratio
• heuristics::srum::is_exfil_volume
• heuristics::srum::is_phantom_foreground
• heuristics::srum::is_process_masquerade
• heuristics::srum::is_suspicious_path
• heuristics::timestamps::has_subsecond_precision
• heuristics::timestamps::is_all_macb_identical
• heuristics::timestamps::is_foreign_file
• heuristics::timestamps::is_future_timestamp
• heuristics::timestamps::is_future_timestamp_beyond_skew
• heuristics::timestamps::is_low_precision_timestamp
• heuristics::timestamps::is_plausible_install_date
• heuristics::timestamps::is_round_hour_timestamp
• history::profiles::sqlite_wal_clock
• journald::is_valid_compression_flags
• journald::is_valid_object_type
• journald::is_valid_state
• jumplist::appid_crc64
• jumplist::appid_name
• lolbins::is_lolbas
• lolbins::is_lolbas_linux
• lolbins::is_lolbas_macos
• lolbins::is_lolbas_windows
• lolbins::is_lolbas_windows_cmdlet
• lolbins::is_lolbas_windows_mmc
• lolbins::is_lolbas_windows_wmi
• lolbins::lolbas_entry
• lolbins::lolbas_names
• mitre::lookup_attack_for_rule_name
• navigator::covered_technique_count
• navigator::covered_techniques
• navigator::findings_to_navigator_layer
• navigator::generate_navigator_layer
• navigator::report_to_navigator_layer
• navigator::technique_coverage
• ntfs::attribute_type_name
• ntfs::filename_namespace::name
• ntfs::mft_record_name
• obf::deobf
• obf::starts_with_obf
• partition_schemes::detect_scheme
• partition_schemes::looks_like_vbr
• partition_types::type_name
• paths::is_hijackable_dll_path
• paths::is_suspicious_staging_path
• paths::is_suspicious_temp_path
• paths::is_trusted_linux_lib_path
• paths::is_trusted_windows_lib_path
• pca::decode_pca_utf16le
• pca::is_pca_file
• pca::parse_pca_line
• peripheral::bus_from_enumerator
• peripheral::is_dma_capable
• peripheral::is_mass_storage
• peripheral::mitre_for
• persistence::all_windows_persistence_paths
• persistence::is_persistence_location
• persistence::is_persistence_path
• persistence::is_suspicious_ifeo_debugger
• playbooks::all_for_artifact
• playbooks::path_by_id
• playbooks::paths_for_artifact
• playbooks::paths_for_trigger
• playbooks::playbook_by_id
• playbooks::scenario_playbooks
• ports::is_c2_port
• ports::is_database_port
• ports::is_suspicious_port
• process_lifetime::is_short_lived
• processes::expected_parent
• processes::expected_parents
• processes::is_credential_access_tool
• processes::is_known_malware_process
• processes::is_lsass_access_tool
• processes::is_masquerade_target
• processes::is_non_networking_process
• processes::is_singleton_process
• processes::is_system32_binary
• references::all_module_references
• references::module_references
• remote_access::all_lolrmm_paths
• remote_access::identify_remote_access_tool
• remote_access::is_known_rat_name
• remote_access::is_remote_access_tool_path
• rootkit::is_known_rootkit_lib
• rootkit::is_rootkit_gid
• services::is_known_service_binary
• services::is_known_service_dll
• shell_history::history_file_name
• shell_history::is_download_pipe_to_shell
• shell_history::is_history_tampering
• shell_history::records_timestamps
• shellbags::is_file_entry
• shellbags::major_class
• sigma::artifacts_covered_by_sigma
• sigma::sigma_refs_for
• stix::artifacts_for_stix_type
• stix::artifacts_with_patterns
• stix::stix_mapping_for
• temporal::correlation_pairs
• temporal::filetime_to_unix_secs
• temporal::temporal_hints_for
• temporal_formats::time_format
• third_party::all_third_party_paths
• third_party::identify_application
• third_party::is_third_party_artifact_path
• threat_intel::engine::score_against_profile
• threat_intel::engine::score_all_profiles
• threat_intel::engine::top_match
• timelining::parsers_for_artifact
• timelining::plaso_parser_by_name
• timelining::tool_by_id
• timestamp_artifacts::timestamp_format_for
• toolchain::kape_mapping_for
• toolchain::kape_target_set
• toolchain::velociraptor_artifact_set
• version_history::changes_in_os_version
• version_history::version_history_for
• version_history::win10_changes
• vmdk::sesparse_decode_grain_index
• vmdk::sesparse_encode_allocated_grain
• volatility::acquisition_order
• volatility::volatility_for
• yara::all_yara_templates
• yara::yara_rule_template

Type Aliases

• history::identity::AppId
• history::identity::SchemaRef
• history::identity::VolumeId
• history::source::SourceId

Statics

• antiforensics_aware::AF_RISKS_TABLE
• artifact::CATALOG
• attack_events::NATIVE_EVENT_TECHNIQUES
• browser_profiles::CONTAINER_APPS
• catalog::CATALOG
• chainsaw::HUNT_RULE_TABLE
• dependencies::ARTIFACT_DEPENDENCIES
• eventids::EVENT_ID_TABLE
• forensicartifacts::FA_TABLE
• jumplist::WELL_KNOWN_APPIDS
• playbooks::INVESTIGATION_PATHS
• playbooks::PLAYBOOKS
• sigma::SIGMA_TABLE
• sqlite::MOZLZ4_MAGIC
• sqlite::SQLITE_MAGIC
• stix::STIX_MAPPINGS
• temporal::TEMPORAL_TABLE
• temporal_formats::TIME_FORMATS
• threat_intel::profiles::ALL_PROFILES
• threat_intel::profiles::AZAZEL
• threat_intel::profiles::BDVL
• threat_intel::profiles::BEURK
• threat_intel::profiles::DIAMORPHINE
• threat_intel::profiles::FATHER
• threat_intel::profiles::JYNX
• threat_intel::profiles::LD_PRELOAD_GENERIC
• threat_intel::profiles::LIB_PROCESS_HIDER
• threat_intel::profiles::LKM_GENERIC
• threat_intel::profiles::MEDUSA
• threat_intel::profiles::NECRO
• threat_intel::profiles::PRISM
• threat_intel::profiles::REPTILE
• threat_intel::profiles::SYSLOGK
• threat_intel::profiles::UMBREON
• threat_intel::profiles::XMRIG
• timelining::PLASO_PARSERS
• timelining::TIMELINE_TOOLS
• toolchain::KAPE_MAPPINGS
• version_history::VERSION_HISTORY_TABLE

Constants

• abusable_sites::ABUSABLE_SITES
• abusable_sites::TAG_C2
• abusable_sites::TAG_DOWNLOAD
• abusable_sites::TAG_EXFIL
• abusable_sites::TAG_EXPLOIT
• abusable_sites::TAG_PHISHING
• aff4::AFF4_NAMESPACE
• aff4::DEFAULT_CHUNKS_PER_SEGMENT
• aff4::DEFAULT_CHUNK_SIZE
• aff4::METADATA_SEGMENT
• aff4::RDF_PREDICATES
• aff4::URI_SCHEME
• aff4::VERSION_SEGMENT
• aff4::ZIP_EOCD_MAGIC
• aff4::ZIP_LOCAL_FILE_HEADER_MAGIC
• antiforensics::KNOWN_ROOTKIT_NAMES
• antiforensics::LOG_WIPE_COMMANDS
• antiforensics::SECURE_DELETE_TOOLS
• antiforensics::SHADOW_COPY_DELETION_PATTERNS
• antiforensics::TIMESTOMP_INDICATORS
• apm::APM_PARTITION_TYPES
• apm::PARTITION_MAP_TYPE
• appcompatcache::ENTRY_FRAMING_LEN
• appcompatcache::ENTRY_MARKER_WIN80
• appcompatcache::ENTRY_MARKER_WIN81_WIN10
• appcompatcache::ENTRY_MARKER_WIN81_WIN10_U32
• appcompatcache::SIG_WIN2003_VISTA
• appcompatcache::SIG_WIN7
• appcompatcache::SIG_WINXP
• appcompatcache::WIN10_1507_HEADER_LEN
• appcompatcache::WIN10_1607_HEADER_LEN
• appcompatcache::WIN10_PATH_TO_FILETIME
• appcompatcache::WIN8X_ENTRY_STREAM_OFFSET
• appcompatcache::WIN8X_PATH_TO_FILETIME_FIXED
• attack_events::FAILED_LOGON_BURST
• beaconing::DEFAULT_BEACONING
• boot_signatures::BOOT_CODE_SIGNATURES
• bootkit::BOOTKIT_MARKERS
• bootkit::EXPECTED_BOOT_INTERRUPT_VECTORS
• bootkit::ORIGINAL_MBR_STASH_SECTORS
• bootkit::PACKED_BOOT_CODE_ENTROPY_STRONG
• bootkit::PACKED_BOOT_CODE_ENTROPY_SUSPECT
• bootkit::TRACK0_GAP
• browser_profiles::CHROMIUM_ARTIFACT_FILES
• browser_profiles::CHROMIUM_PROFILE_MARKERS
• browser_profiles::CHROMIUM_SESSION_FILE_PREFIXES
• browser_profiles::FIREFOX_PROFILE_MARKERS
• browser_profiles::FIREFOX_PROFILE_MARKER_SUFFIXES
• commands::CREDENTIAL_DUMP_PATTERNS
• commands::DEFENSE_EVASION_PATTERNS
• commands::DOWNLOAD_TOOL_PATTERNS
• commands::LATERAL_MOVEMENT_PATTERNS
• commands::POWERSHELL_ABUSE_PATTERNS
• commands::RECON_PATTERNS
• commands::REVERSE_SHELL_PATTERNS
• commands::WMI_ABUSE_PATTERNS
• decmpfs::CHUNK_SIZE
• decmpfs::COMPRESSION_TYPE_OFFSET
• decmpfs::HEADER_LEN
• decmpfs::MAGIC
• decmpfs::UNCOMPRESSED_SIZE_OFFSET
• dmg::BLK_ADC
• dmg::BLK_BZIP2
• dmg::BLK_COMMENT
• dmg::BLK_IGNORE
• dmg::BLK_LZFSE
• dmg::BLK_RAW
• dmg::BLK_TERMINATOR
• dmg::BLK_ZERO
• dmg::BLK_ZLIB
• dmg::KOLY_MAGIC
• dmg::KOLY_OFFSETS
• dmg::KOLY_SIZE
• dmg::MISH_MAGIC
• dpapi::CALG_3DES
• dpapi::CALG_AES_256
• dpapi::CALG_HMAC
• dpapi::CALG_SHA1
• dpapi::CALG_SHA_512
• dpapi::CHROME_COOKIE_V10
• dpapi::CHROME_COOKIE_V20
• dpapi::PROVIDER_GUID_BYTES
• drivers::BYOVD_DRIVERS
• drivers::BYOVD_DRIVER_NAMES
• drivers::KNOWN_VULNERABLE_DRIVERS
• encryption::BITLOCKER_PATHS
• encryption::EFS_PATHS
• encryption::RANSOMWARE_EXTENSIONS
• encryption::SEVENZIP_PATHS
• encryption::TOR_PATHS
• encryption::VERACRYPT_PATHS
• encryption::WINRAR_PATHS
• eol_os::EOL_OS
• evtx::CHUNK_HEADER_CRC_OFFSET
• evtx::CHUNK_HEADER_CRC_RANGE
• evtx::CHUNK_HEADER_SIZE
• evtx::CHUNK_RECORDS_OFFSET
• evtx::CHUNK_SIZE
• evtx::ELFCHNK_MAGIC
• evtx::ELFFILE_MAGIC
• evtx::EVENT_RECORDS_CRC_OFFSET
• evtx::EVTX_CHUNK_HEADER_OFFSETS
• evtx::EVTX_FILE_HEADER_OFFSETS
• evtx::FILE_FLAG_DIRTY
• evtx::FILE_FLAG_FULL
• evtx::FILE_HEADER_BLOCK_SIZE
• evtx::FILE_HEADER_SIZE
• evtx::RECORD_HEADER_SIZE
• evtx::RECORD_MAGIC
• ewf::COMPRESSION_BEST
• ewf::COMPRESSION_FAST
• ewf::COMPRESSION_NONE
• ewf::EVF1_SIGNATURE
• ewf::EVF2_SIGNATURE
• ewf::EWF1_SECTION_TYPES
• ewf::LEF2_SIGNATURE
• ewf::SIGNATURE_LEN
• ewf::TABLE_ENTRY_COMPRESSED_FLAG
• filesystems::FILESYSTEM_SIGNATURES
• gpt::PARTITION_TYPE_GUIDS
• gpt::UNUSED_GUID
• gpt::attributes::LEGACY_BIOS_BOOTABLE
• gpt::attributes::MS_HIDDEN
• gpt::attributes::MS_NO_DRIVE_LETTER
• gpt::attributes::MS_READ_ONLY
• gpt::attributes::MS_SHADOW_COPY
• gpt::attributes::NO_BLOCK_IO
• gpt::attributes::REQUIRED
• heuristics::BEACON_JITTER_PPT
• heuristics::BORN_BEFORE_INSTALL_THRESHOLD_NS
• heuristics::COMMON_TUNNEL_PORTS
• heuristics::CORE_DATA_EPOCH_OFFSET_SECS
• heuristics::FILETIME_EPOCH_DIFF_100NS
• heuristics::LARGE_FILE_THRESHOLD_BYTES
• heuristics::MAX_REGISTERED_PORT
• heuristics::MAX_RESERVED_PORT
• heuristics::MAX_SYSTEM_UID
• heuristics::MINER_STRATUM_PORTS
• heuristics::MIN_EPHEMERAL_PORT
• heuristics::MIN_MEANINGFUL_FILE_BYTES
• heuristics::MIN_RESERVED_PORT
• heuristics::NULL_TIMESTAMP_WINDOW_NS
• heuristics::RAPID_ACCESS_THRESHOLD_NS
• heuristics::SI_PRECEDES_FN_THRESHOLD_NS
• heuristics::WEBKIT_EPOCH_OFFSET_US
• heuristics::WORKING_HOURS_END
• heuristics::WORKING_HOURS_START
• heuristics::entropy::HIGH_ENTROPY_THRESHOLD
• heuristics::entropy::MAX_BYTE_ENTROPY
• heuristics::entropy::PACKED_SECTION_THRESHOLD
• heuristics::evtx::ADEXPLORER_EULAACCEPTED_KEY_FRAGMENT
• heuristics::evtx::ADMIN_SHARE_NAMES
• heuristics::evtx::AMSI_BYPASS_PATTERNS
• heuristics::evtx::ARCHIVER_HEADER_ENCRYPT_FLAG
• heuristics::evtx::ARCHIVER_PROCESS_NAMES
• heuristics::evtx::BCDEDIT_RECOVERY_DISABLE_PATTERNS
• heuristics::evtx::BIG_THREE_CHANNELS
• heuristics::evtx::BITS_CLIENT_CHANNEL
• heuristics::evtx::BROWSER_PROCESS_NAMES
• heuristics::evtx::BROWSER_UPDATE_TASK_PATTERNS
• heuristics::evtx::BYOVD_DRIVER_NAMES
• heuristics::evtx::CHISEL_CMDLINE_INDICATORS
• heuristics::evtx::CLOUDFLARE_WORKERS_DOMAIN_SUFFIX
• heuristics::evtx::COMSVCS_MINIDUMP_PATTERNS
• heuristics::evtx::DEFENDER_CHANNEL
• heuristics::evtx::DEFENDER_TAMPER_PATTERNS
• heuristics::evtx::EID_BITS_TRANSFER_COMPLETE
• heuristics::evtx::EID_BITS_TRANSFER_START
• heuristics::evtx::EID_BOOT
• heuristics::evtx::EID_CHANNEL_LOG_CLEARED
• heuristics::evtx::EID_DEFENDER_CONFIG_CHANGED
• heuristics::evtx::EID_DEFENDER_MALWARE_DETECTED
• heuristics::evtx::EID_DEFENDER_REALTIME_DISABLED
• heuristics::evtx::EID_DIRECTORY_SERVICE_ACCESS
• heuristics::evtx::EID_HYPERV_VM_STATE_CHANGE
• heuristics::evtx::EID_HYPERV_VM_STOPPED
• heuristics::evtx::EID_KERBEROS_TGS_REQUEST
• heuristics::evtx::EID_KERBEROS_TGT_REQUEST
• heuristics::evtx::EID_LOGOFF
• heuristics::evtx::EID_LOGOFF_USER
• heuristics::evtx::EID_LOGON
• heuristics::evtx::EID_LOGON_FAILURE
• heuristics::evtx::EID_LOG_CLEARED
• heuristics::evtx::EID_LOG_CLEARED_SYSTEM
• heuristics::evtx::EID_PROCESS_CREATE
• heuristics::evtx::EID_PROCESS_EXIT
• heuristics::evtx::EID_PS_SCRIPT_BLOCK
• heuristics::evtx::EID_REGISTRY_VALUE_SET
• heuristics::evtx::EID_SCM_SERVICE_STATE_CHANGE
• heuristics::evtx::EID_SECURITY_TASK_CREATED
• heuristics::evtx::EID_SERVICE_INSTALLED
• heuristics::evtx::EID_SERVICE_INSTALLED_SECURITY
• heuristics::evtx::EID_SHUTDOWN
• heuristics::evtx::EID_SMB_OBJECT_ACCESS
• heuristics::evtx::EID_SMB_SHARE_ACCESS
• heuristics::evtx::EID_SPECIAL_LOGON
• heuristics::evtx::EID_SYSMON_CONFIG_CHANGE
• heuristics::evtx::EID_SYSMON_DNS_QUERY
• heuristics::evtx::EID_SYSMON_DRIVER_LOAD
• heuristics::evtx::EID_SYSMON_DRIVER_UNLOAD
• heuristics::evtx::EID_SYSMON_FILE_CREATE
• heuristics::evtx::EID_SYSMON_FILE_CREATE_STREAM_HASH
• heuristics::evtx::EID_SYSMON_FILE_DELETE
• heuristics::evtx::EID_SYSMON_FILE_DELETE_DETECTED
• heuristics::evtx::EID_SYSMON_IMAGE_LOAD
• heuristics::evtx::EID_SYSMON_NETWORK_CONNECT
• heuristics::evtx::EID_SYSMON_PROCESS_ACCESS
• heuristics::evtx::EID_SYSMON_PROCESS_CREATE
• heuristics::evtx::EID_SYSMON_REGISTRY_ADD
• heuristics::evtx::EID_SYSMON_REGISTRY_MODIFY
• heuristics::evtx::EID_TASK_COMPLETED
• heuristics::evtx::EID_TASK_DELETED
• heuristics::evtx::EID_TASK_LAUNCHED
• heuristics::evtx::EID_TASK_REGISTERED
• heuristics::evtx::EID_TASK_UPDATED
• heuristics::evtx::EID_UNEXPECTED_SHUTDOWN
• heuristics::evtx::EID_USER_ACCOUNT_CREATED
• heuristics::evtx::EID_USER_ADDED_TO_LOCAL_GROUP
• heuristics::evtx::EID_VSS_ERROR
• heuristics::evtx::EID_VSS_SNAPSHOT_DELETED
• heuristics::evtx::EID_W32TIME_NTP_FAILED
• heuristics::evtx::EID_W32TIME_SYNC
• heuristics::evtx::EID_WMI_FILTER_SUBSCRIBED
• heuristics::evtx::EID_WMI_FILTER_TRIGGERED
• heuristics::evtx::EID_WMI_OPERATION_FAILURE
• heuristics::evtx::EID_WMI_QUERY
• heuristics::evtx::GUID_DS_REPLICATION_FILTERED
• heuristics::evtx::GUID_DS_REPLICATION_GET_CHANGES
• heuristics::evtx::GUID_DS_REPLICATION_GET_CHANGES_ALL
• heuristics::evtx::HVCI_REGISTRY_KEY_PATHS
• heuristics::evtx::HVCI_REGISTRY_VALUE_NAMES
• heuristics::evtx::HYPERV_VMMS_CHANNEL
• heuristics::evtx::LOCAL_ADMINS_GROUP_SID
• heuristics::evtx::LOW_VOLUME_CHANNEL_MAX_RECORDS
• heuristics::evtx::LSASS_DUMP_ACCESS_MASKS
• heuristics::evtx::LSASS_IMAGE_NAME
• heuristics::evtx::POWERSHELL_OPERATIONAL_CHANNEL
• heuristics::evtx::PSEXEC_SERVICE_PATTERNS
• heuristics::evtx::PS_CLEAR_EVENTLOG_PATTERNS
• heuristics::evtx::PS_HISTORY_PATH_FRAGMENT
• heuristics::evtx::QWCRYPT_IOC_EXTENSION
• heuristics::evtx::QWCRYPT_IOC_FILENAMES
• heuristics::evtx::QWCRYPT_IOC_IPS
• heuristics::evtx::QWCRYPT_PS_PATTERNS
• heuristics::evtx::RARE_SOURCE_ID_PAIR_MAX
• heuristics::evtx::RDP_FDENYTSC_KEY_FRAGMENT
• heuristics::evtx::RESERVED_EVENT_ID_MAX
• heuristics::evtx::RMM_BINARY_NAMES
• heuristics::evtx::RMM_SAFE_INSTALL_PATHS
• heuristics::evtx::RPIVOT_CMDLINE_INDICATORS
• heuristics::evtx::SHELL_PARENT_PROCESS_NAMES
• heuristics::evtx::SIDELOAD_HIJACK_DLLS
• heuristics::evtx::STAGING_ARCHIVE_EXTENSIONS
• heuristics::evtx::STAGING_PARENT_IMAGES
• heuristics::evtx::SUPER_TIMELINE_CHANNELS
• heuristics::evtx::SYSMON_CHANNEL
• heuristics::evtx::SYSMON_FIELD_COMMAND_LINE
• heuristics::evtx::SYSMON_FIELD_DEST_IP
• heuristics::evtx::SYSMON_FIELD_DEST_PORT
• heuristics::evtx::SYSMON_FIELD_GRANTED_ACCESS
• heuristics::evtx::SYSMON_FIELD_IMAGE
• heuristics::evtx::SYSMON_FIELD_PARENT_COMMAND_LINE
• heuristics::evtx::SYSMON_FIELD_PARENT_IMAGE
• heuristics::evtx::SYSMON_FIELD_PARENT_PROCESS_GUID
• heuristics::evtx::SYSMON_FIELD_PROCESS_GUID
• heuristics::evtx::SYSMON_FIELD_QUERY_NAME
• heuristics::evtx::SYSMON_FIELD_SOURCE_IP
• heuristics::evtx::SYSMON_FIELD_TARGET_FILENAME
• heuristics::evtx::SYSMON_FIELD_TARGET_IMAGE
• heuristics::evtx::SYSTEM_CHANNEL
• heuristics::evtx::SYSTEM_DLL_SAFE_PATH_PREFIXES
• heuristics::evtx::TASKSCHEDULER_CHANNEL
• heuristics::evtx::TASKSCHEDULER_OPERATIONAL_CHANNEL
• heuristics::evtx::VSSADMIN_SHADOW_DELETE_PATTERNS
• heuristics::evtx::WEBCLIENT_SERVICE_NAME
• heuristics::evtx::WEBDAV_COMMANDLINE_INDICATORS
• heuristics::evtx::WEBDAV_LOL_PROCESSES
• heuristics::evtx::WEVTUTIL_CLEAR_SUBSTRINGS
• heuristics::evtx::WMIC_SHADOW_DELETE_PATTERNS
• heuristics::evtx::WMI_ACTIVITY_CHANNEL
• heuristics::evtx::WMI_IMPACKET_INDICATORS
• heuristics::evtx::ZEMANA_SIGNER_THUMBPRINT
• heuristics::linux_rootkit::FATHER_CLASS_ELF_PATTERNS
• heuristics::linux_rootkit::ROOTKIT_HOOK_SYMBOLS
• heuristics::memory::KERNEL_SPACE_MIN_X64
• heuristics::memory::PAGE_EXECUTE_READWRITE
• heuristics::memory::PAGE_EXECUTE_WRITECOPY
• heuristics::memory::PAGE_SIZE_BYTES
• heuristics::memory::USER_SPACE_MAX_X64
• heuristics::network::DGA_MAX_VOWEL_RATIO_PPT
• heuristics::network::DGA_MIN_CONSONANT_RUN
• heuristics::network::DGA_MIN_LENGTH
• heuristics::paths::CONSOLE_KNOWN_VALUE_NAMES
• heuristics::paths::SUSPICIOUS_EXEC_PREFIXES
• heuristics::paths::ZONE_INTERNET
• heuristics::paths::ZONE_INTRANET
• heuristics::paths::ZONE_LOCAL
• heuristics::paths::ZONE_RESTRICTED
• heuristics::paths::ZONE_TRUSTED
• heuristics::pe::ANTI_DEBUG_IMPORT_NAMES
• heuristics::pe::AV_EXCLUSION_PATH_FRAGMENTS
• heuristics::pe::CREDENTIAL_PATTERNS
• heuristics::pe::MACHINE_AMD64
• heuristics::pe::MACHINE_ARM64
• heuristics::pe::MACHINE_I386
• heuristics::pe::MZ_MAGIC
• heuristics::pe::NETWORK_C2_PATTERNS
• heuristics::pe::PACKED_SECTION_NAMES
• heuristics::pe::PERSISTENCE_STRING_PATTERNS
• heuristics::pe::PE_SIGNATURE
• heuristics::pe::PROCESS_HOLLOWING_APIS
• heuristics::pe::QWCRYPT_PE_STRING_IOCS
• heuristics::pe::RANSOMWARE_STRING_PATTERNS
• heuristics::pe::SUSPICIOUS_IMPORT_NAMES
• heuristics::process::CAP_DAC_OVERRIDE
• heuristics::process::CAP_NET_RAW
• heuristics::process::CAP_SYS_ADMIN
• heuristics::process::CAP_SYS_PTRACE
• heuristics::process::DANGEROUS_CAPS
• heuristics::process::LOGON_BATCH
• heuristics::process::LOGON_CACHED_INTERACTIVE
• heuristics::process::LOGON_CACHED_REMOTE_INTERACTIVE
• heuristics::process::LOGON_CACHED_UNLOCK
• heuristics::process::LOGON_INTERACTIVE
• heuristics::process::LOGON_NETWORK
• heuristics::process::LOGON_NETWORK_CLEARTEXT
• heuristics::process::LOGON_NEW_CREDENTIALS
• heuristics::process::LOGON_REMOTE_INTERACTIVE
• heuristics::process::LOGON_SERVICE
• heuristics::process::LOGON_SYSTEM
• heuristics::process::LOGON_UNLOCK
• heuristics::process::OPENSSH_VIRTUAL_USERS_DOMAIN
• heuristics::process::SUSPICIOUS_PID_GAP
• heuristics::process::TOKEN_ELEVATION_FULL
• heuristics::ransomware::RANSOMWARE_KILL_CLUSTER_THRESHOLD
• heuristics::ransomware::RANSOMWARE_KILL_PROCESSES
• heuristics::ransomware::RANSOMWARE_KILL_WINDOW_NS
• heuristics::ransomware::RANSOMWARE_SERVICE_STOP_CLUSTER_THRESHOLD
• heuristics::ransomware::RANSOMWARE_STOP_SERVICES
• heuristics::ransomware::RANSOM_NOTE_FILENAMES
• heuristics::srum::AUTOMATED_EXECUTION_FOCUS_THRESHOLD_MS
• heuristics::srum::BACKGROUND_CPU_DOMINANCE_RATIO
• heuristics::srum::BEACON_COV_THRESHOLD
• heuristics::srum::BEACON_MAX_INTERVAL_SECS
• heuristics::srum::BEACON_MIN_INTERVAL_SECS
• heuristics::srum::BEACON_MIN_SAMPLES
• heuristics::srum::EXFIL_BYTES_RATIO
• heuristics::srum::EXFIL_VOLUME_BYTES
• heuristics::srum::PHANTOM_FOREGROUND_MIN_CYCLES
• heuristics::timestamps::CLOCK_SKEW_TOLERANCE_NS
• heuristics::timestamps::MIN_PLAUSIBLE_INSTALL_DATE_SECS
• history::profiles::SQLITE_WAL_SAFETY
• journald::JOURNAL_MAGIC
• journald::compression::LZ4
• journald::compression::NONE
• journald::compression::XZ
• journald::compression::ZSTD
• journald::cursor::BOOT_ID_KEY
• journald::cursor::KEY_VALUE_SEP
• journald::cursor::MONOTONIC_KEY
• journald::cursor::REALTIME_KEY
• journald::cursor::SEPARATOR
• journald::cursor::SEQNUM_ID_KEY
• journald::cursor::SEQNUM_KEY
• journald::cursor::XOR_HASH_KEY
• journald::field::BOOT_ID
• journald::field::CMDLINE
• journald::field::COMM
• journald::field::CURSOR
• journald::field::EXE
• journald::field::GID
• journald::field::HOSTNAME
• journald::field::KERNEL_SUBSYSTEM
• journald::field::MACHINE_ID
• journald::field::MESSAGE
• journald::field::MONOTONIC_TIMESTAMP
• journald::field::PID
• journald::field::PRIORITY
• journald::field::REALTIME_TIMESTAMP
• journald::field::SOURCE_REALTIME_TIMESTAMP
• journald::field::SYSLOG_FACILITY
• journald::field::SYSLOG_IDENTIFIER
• journald::field::SYSLOG_PID
• journald::field::SYSTEMD_UNIT
• journald::field::SYSTEMD_USER_UNIT
• journald::field::TRANSPORT
• journald::field::UID
• journald::header_offset::ARENA_SIZE
• journald::header_offset::BOOT_ID
• journald::header_offset::COMPATIBLE_FLAGS
• journald::header_offset::DATA_HASH_TABLE_OFFSET
• journald::header_offset::DATA_HASH_TABLE_SIZE
• journald::header_offset::ENTRY_ARRAY_OFFSET
• journald::header_offset::FIELD_HASH_TABLE_OFFSET
• journald::header_offset::FIELD_HASH_TABLE_SIZE
• journald::header_offset::FILE_ID
• journald::header_offset::HEADER_SIZE
• journald::header_offset::HEAD_ENTRY_REALTIME
• journald::header_offset::HEAD_ENTRY_SEQNUM
• journald::header_offset::INCOMPATIBLE_FLAGS
• journald::header_offset::MACHINE_ID
• journald::header_offset::MAGIC
• journald::header_offset::MIN_HEADER_SIZE
• journald::header_offset::N_ENTRIES
• journald::header_offset::N_OBJECTS
• journald::header_offset::RESERVED
• journald::header_offset::SEQNUM_ID
• journald::header_offset::STATE
• journald::header_offset::TAIL_ENTRY_REALTIME
• journald::header_offset::TAIL_ENTRY_SEQNUM
• journald::header_offset::TAIL_OBJECT_OFFSET
• journald::object_header_offset::FLAGS
• journald::object_header_offset::HEADER_SIZE
• journald::object_header_offset::RESERVED
• journald::object_header_offset::SIZE
• journald::object_header_offset::TYPE
• journald::object_type::ALL
• journald::object_type::DATA
• journald::object_type::DATA_HASH_TABLE
• journald::object_type::ENTRY
• journald::object_type::ENTRY_ARRAY
• journald::object_type::FIELD
• journald::object_type::FIELD_HASH_TABLE
• journald::object_type::TAG
• journald::object_type::UNUSED
• journald::state::ARCHIVED
• journald::state::OFFLINE
• journald::state::ONLINE
• jumplist::APPID_CRC64_POLY
• jumplist::CUSTOM_DESTINATIONS_FOOTER_SIGNATURE
• jumplist::CUSTOM_DESTINATIONS_FORMAT_VERSION
• jumplist::DESTLIST_ENTRY_BIRTH_DROID_FILE_GUID_OFFSET
• jumplist::DESTLIST_ENTRY_BIRTH_DROID_VOLUME_GUID_OFFSET
• jumplist::DESTLIST_ENTRY_DROID_FILE_GUID_OFFSET
• jumplist::DESTLIST_ENTRY_DROID_VOLUME_GUID_OFFSET
• jumplist::DESTLIST_ENTRY_ENTRY_NUMBER_OFFSET
• jumplist::DESTLIST_ENTRY_HOSTNAME_OFFSET
• jumplist::DESTLIST_ENTRY_HOSTNAME_SIZE
• jumplist::DESTLIST_ENTRY_LAST_ACCESS_FILETIME_OFFSET
• jumplist::DESTLIST_ENTRY_PIN_STATUS_OFFSET
• jumplist::DESTLIST_ENTRY_V1_PATH_OFFSET
• jumplist::DESTLIST_ENTRY_V1_PATH_SIZE_OFFSET
• jumplist::DESTLIST_ENTRY_V2_ACCESS_COUNT_OFFSET
• jumplist::DESTLIST_ENTRY_V2_PATH_OFFSET
• jumplist::DESTLIST_ENTRY_V2_PATH_SIZE_OFFSET
• jumplist::DESTLIST_ENTRY_V2_STATUS_OFFSET
• jumplist::DESTLIST_ENTRY_V2_TRAILING_ALIGNMENT
• jumplist::DESTLIST_ENTRY_V2_UNKNOWN_OFFSET
• jumplist::DESTLIST_FORMAT_VERSION_WIN10
• jumplist::DESTLIST_FORMAT_VERSION_WIN7
• jumplist::DESTLIST_HEADER_ENTRY_COUNT_OFFSET
• jumplist::DESTLIST_HEADER_FORMAT_VERSION_OFFSET
• jumplist::DESTLIST_HEADER_LAST_ENTRY_NUMBER_OFFSET
• jumplist::DESTLIST_HEADER_LAST_REVISION_OFFSET
• jumplist::DESTLIST_HEADER_PINNED_COUNT_OFFSET
• jumplist::DESTLIST_HEADER_SIZE
• jumplist::DESTLIST_PIN_STATUS_UNPINNED
• jumplist::LNK_CLSID
• lolbins::LOLBAS_LINUX
• lolbins::LOLBAS_MACOS
• lolbins::LOLBAS_WINDOWS
• lolbins::LOLBAS_WINDOWS_CMDLETS
• lolbins::LOLBAS_WINDOWS_MMC
• lolbins::LOLBAS_WINDOWS_WMI
• lolbins::UC_ARCHIVE
• lolbins::UC_BYPASS
• lolbins::UC_CREDENTIALS
• lolbins::UC_DECODE
• lolbins::UC_DEFENSE_EVASION
• lolbins::UC_DOWNLOAD
• lolbins::UC_EXECUTE
• lolbins::UC_NETWORK
• lolbins::UC_PERSIST
• lolbins::UC_PROXY
• lolbins::UC_RECON
• lolbins::UC_UPLOAD
• ntfs::ATTRIBUTE_TYPES
• ntfs::MFT_RECORD_NAMES
• ntfs::OEM_ID
• ntfs::SIGNATURE_BAAD
• ntfs::SIGNATURE_FILE
• ntfs::SIGNATURE_INDX
• ntfs::attr_flags::COMPRESSED
• ntfs::attr_flags::ENCRYPTED
• ntfs::attr_flags::SPARSE
• ntfs::attr_offsets::ATTRIBUTE_ID
• ntfs::attr_offsets::FLAGS
• ntfs::attr_offsets::LENGTH
• ntfs::attr_offsets::NAME_LENGTH
• ntfs::attr_offsets::NAME_OFFSET
• ntfs::attr_offsets::NON_RESIDENT
• ntfs::attr_offsets::NR_ALLOCATED_SIZE
• ntfs::attr_offsets::NR_COMPRESSION_UNIT
• ntfs::attr_offsets::NR_INITIALIZED_SIZE
• ntfs::attr_offsets::NR_LAST_VCN
• ntfs::attr_offsets::NR_REAL_SIZE
• ntfs::attr_offsets::NR_RUNS_OFFSET
• ntfs::attr_offsets::NR_START_VCN
• ntfs::attr_offsets::RES_CONTENT_LENGTH
• ntfs::attr_offsets::RES_CONTENT_OFFSET
• ntfs::attr_offsets::TYPE
• ntfs::attr_types::ATTRIBUTE_LIST
• ntfs::attr_types::BITMAP
• ntfs::attr_types::DATA
• ntfs::attr_types::EA
• ntfs::attr_types::EA_INFORMATION
• ntfs::attr_types::END
• ntfs::attr_types::FILE_NAME
• ntfs::attr_types::INDEX_ALLOCATION
• ntfs::attr_types::INDEX_ROOT
• ntfs::attr_types::LOGGED_UTILITY_STREAM
• ntfs::attr_types::OBJECT_ID
• ntfs::attr_types::PROPERTY_SET
• ntfs::attr_types::REPARSE_POINT
• ntfs::attr_types::SECURITY_DESCRIPTOR
• ntfs::attr_types::STANDARD_INFORMATION
• ntfs::attr_types::VOLUME_INFORMATION
• ntfs::attr_types::VOLUME_NAME
• ntfs::boot_offsets::BYTES_PER_SECTOR
• ntfs::boot_offsets::CLUSTERS_PER_INDEX
• ntfs::boot_offsets::CLUSTERS_PER_RECORD
• ntfs::boot_offsets::MFTMIRR_LCN
• ntfs::boot_offsets::MFT_LCN
• ntfs::boot_offsets::OEM_ID
• ntfs::boot_offsets::SECTORS_PER_CLUSTER
• ntfs::boot_offsets::TOTAL_SECTORS
• ntfs::boot_offsets::VOLUME_SERIAL
• ntfs::file_attributes::ARCHIVE
• ntfs::file_attributes::COMPRESSED
• ntfs::file_attributes::ENCRYPTED
• ntfs::file_attributes::HIDDEN
• ntfs::file_attributes::READONLY
• ntfs::file_attributes::REPARSE_POINT
• ntfs::file_attributes::SPARSE_FILE
• ntfs::file_attributes::SYSTEM
• ntfs::file_attributes::TEMPORARY
• ntfs::filename_namespace::DOS
• ntfs::filename_namespace::POSIX
• ntfs::filename_namespace::WIN32
• ntfs::filename_namespace::WIN32_AND_DOS
• ntfs::mft_flags::DIRECTORY
• ntfs::mft_flags::EXTENSION
• ntfs::mft_flags::IN_USE
• ntfs::mft_flags::VIEW_INDEX
• ntfs::mft_offsets::ALLOCATED_SIZE
• ntfs::mft_offsets::BASE_RECORD
• ntfs::mft_offsets::FIRST_ATTRIBUTE
• ntfs::mft_offsets::FLAGS
• ntfs::mft_offsets::HARD_LINK_COUNT
• ntfs::mft_offsets::LSN
• ntfs::mft_offsets::NEXT_ATTR_ID
• ntfs::mft_offsets::RECORD_NUMBER
• ntfs::mft_offsets::SEQUENCE_NUMBER
• ntfs::mft_offsets::SIGNATURE
• ntfs::mft_offsets::USA_COUNT
• ntfs::mft_offsets::USA_OFFSET
• ntfs::mft_offsets::USED_SIZE
• ntfs::mft_records::ATTRDEF
• ntfs::mft_records::BADCLUS
• ntfs::mft_records::BITMAP
• ntfs::mft_records::BOOT
• ntfs::mft_records::EXTEND
• ntfs::mft_records::LOGFILE
• ntfs::mft_records::MFT
• ntfs::mft_records::MFTMIRR
• ntfs::mft_records::ROOT
• ntfs::mft_records::SECURE
• ntfs::mft_records::UPCASE
• ntfs::mft_records::VOLUME
• obf::OBF_KEY
• olecf::BYTE_ORDER
• olecf::BYTE_ORDER_LE
• olecf::CHILD
• olecf::CLSID
• olecf::COLOR
• olecf::CREATE_TIME
• olecf::DIFAT_HEADER_COUNT
• olecf::DIFAT_HEADER_OFFSET
• olecf::DIFSECT
• olecf::DIR_ENTRY_SIZE
• olecf::ENDOFCHAIN
• olecf::FATSECT
• olecf::FIRST_DIFAT_SECTOR
• olecf::FIRST_DIR_SECTOR
• olecf::FIRST_MINIFAT_SECTOR
• olecf::FREESECT
• olecf::HEADER_SIZE
• olecf::LEFT_SIBLING
• olecf::MAJOR_VERSION
• olecf::MAXREGSECT
• olecf::MINI_SECTOR_SHIFT
• olecf::MINI_SECTOR_SHIFT_VALUE
• olecf::MINI_SECTOR_SIZE
• olecf::MINI_STREAM_CUTOFF
• olecf::MINI_STREAM_CUTOFF_VALUE
• olecf::MINOR_VERSION
• olecf::MODIFY_TIME
• olecf::NAME
• olecf::NAME_LEN
• olecf::NOSTREAM
• olecf::NUM_DIFAT_SECTORS
• olecf::NUM_DIR_SECTORS
• olecf::NUM_FAT_SECTORS
• olecf::NUM_MINIFAT_SECTORS
• olecf::OBJECT_TYPE
• olecf::OLECF_SIGNATURE
• olecf::RIGHT_SIBLING
• olecf::SECTOR_SHIFT
• olecf::SECTOR_SHIFT_V3
• olecf::SECTOR_SHIFT_V4
• olecf::START_SECTOR
• olecf::STATE_BITS
• olecf::STREAM_SIZE
• partition_schemes::APM_DDR_MAGIC
• partition_schemes::GPT_HEADER_MAGIC
• partition_schemes::MBR_BOOT_SIGNATURE
• partition_schemes::MBR_BOOT_SIGNATURE_OFFSET
• partition_types::PARTITION_TYPES
• pca::PCA_ALL_PATHS
• pca::PCA_APPLAUNCH_DIC_PATH
• pca::PCA_DIR
• pca::PCA_GENERAL_DB0_PATH
• pca::PCA_GENERAL_DB1_PATH
• peripheral::DEVICE_PROPERTIES_GUID
• peripheral::MITRE_DMA
• peripheral::MITRE_HID
• peripheral::MITRE_MASS_STORAGE
• peripheral::PROPERTY_FIRST_INSTALL_DATE
• peripheral::PROPERTY_INSTALL_DATE
• peripheral::PROPERTY_LAST_ARRIVAL_DATE
• peripheral::PROPERTY_LAST_REMOVAL_DATE
• persistence::ACTIVE_SETUP_PATHS
• persistence::APPINIT_PATHS
• persistence::COM_HIJACK_PATHS
• persistence::IFEO_PATHS
• persistence::LINUX_PERSISTENCE_PATHS
• persistence::MACOS_PERSISTENCE_PATHS
• persistence::SCREENSAVER_PATHS
• persistence::SESSION_MANAGER_PATHS
• persistence::WINDOWS_RUN_KEYS
• persistence::WINLOGON_PATHS
• ports::C2_FRAMEWORK_PORTS
• ports::DATABASE_PORTS
• ports::SUSPICIOUS_PORTS
• process_lifetime::SHORT_LIVED_THRESHOLD_SECONDS
• processes::CREDENTIAL_ACCESS_TOOLS
• processes::KNOWN_MALWARE_PROCESS_NAMES
• processes::LSASS_ACCESS_TOOLS
• processes::PE_MZ_MAGIC
• processes::WINDOWS_KERNEL_PDB_PREFIXES
• processes::WINDOWS_MASQUERADE_TARGETS
• processes::WINDOWS_NON_NETWORKING_PROCESSES
• processes::WINDOWS_PARENT_RULES
• processes::WINDOWS_PPID_RULES
• processes::WINDOWS_SINGLETON_PROCESSES
• processes::WINDOWS_SYSTEM32_BINARIES
• qcow2::CLUSTER_BITS_MAX
• qcow2::CLUSTER_BITS_MIN
• qcow2::CRYPT_AES
• qcow2::CRYPT_LUKS
• qcow2::CRYPT_NONE
• qcow2::HEADER_OFFSETS
• qcow2::INCOMPAT_COMPRESSION_TYPE
• qcow2::INCOMPAT_CORRUPT
• qcow2::INCOMPAT_DIRTY
• qcow2::INCOMPAT_EXTENDED_L2
• qcow2::INCOMPAT_EXTERNAL_DATA
• qcow2::L1_ENTRY_COPIED
• qcow2::L2_ENTRY_COMPRESSED
• qcow2::MAGIC
• qcow2::V2_HEADER_SIZE
• qcow2::VERSION_MAX
• qcow2::VERSION_MIN
• references::ANTIFORENSICS_REFERENCES
• references::ARTIFACT_REFERENCES
• references::COMMANDS_REFERENCES
• references::ENCRYPTION_REFERENCES
• references::LOLBINS_REFERENCES
• references::MODULE_REFERENCES
• references::PATHS_REFERENCES
• references::PCA_REFERENCES
• references::PERSISTENCE_REFERENCES
• references::PORTS_REFERENCES
• references::PROCESSES_REFERENCES
• references::REMOTE_ACCESS_REFERENCES
• references::THIRD_PARTY_REFERENCES
• remote_access::ACTION1_PATHS
• remote_access::ANYDESK_PATHS
• remote_access::ATERA_PATHS
• remote_access::GOTOASSIST_PATHS
• remote_access::KNOWN_RAT_NAMES
• remote_access::MANAGEENGINE_PATHS
• remote_access::SPLASHTOP_PATHS
• remote_access::TEAMVIEWER_PATHS
• rootkit::KNOWN_LD_PRELOAD_ROOTKITS
• rootkit::father::BACKDOOR_SOURCE_PORT
• rootkit::father::CONFIG_MAGIC
• rootkit::father::DEFAULT_PRELOAD_PATH
• rootkit::father::HIDDEN_PORT
• rootkit::father::MAGIC_GID
• rootkit::father::PAM_ARTIFACT_PATH
• rootkit::father::SHELL_PASS
• services::KNOWN_WINDOWS_SERVICE_BINARIES
• services::KNOWN_WINDOWS_SERVICE_DLLS
• services::SVCHOST_HOST_BINARY
• shell_history::BASH_TIMESTAMP_PREFIX
• shell_history::DOWNLOAD_PIPE_TO_SHELL_PATTERNS
• shell_history::FISH_CMD_PREFIX
• shell_history::FISH_WHEN_PREFIX
• shell_history::HISTORY_CLEARING_PATTERNS
• shell_history::MITRE_DOWNLOAD_PIPE_TO_SHELL
• shell_history::MITRE_HISTORY_CLEARING
• shell_history::ZSH_EXTENDED_ENTRY_PREFIX
• shell_history::ZSH_EXTENDED_FIELD_SEPARATOR
• shellbags::CLASS_FILE_ENTRY_35
• shellbags::CLASS_FILE_ENTRY_36
• shellbags::CLASS_FILE_ENTRY_DIRECTORY
• shellbags::CLASS_FILE_ENTRY_FILE
• shellbags::CLASS_FILE_ENTRY_UNICODE
• shellbags::CLASS_NETWORK_LOCATION
• shellbags::CLASS_ROOT_FOLDER
• shellbags::CLASS_TYPE_MASK
• shellbags::CLASS_VOLUME_2E
• shellbags::CLASS_VOLUME_2F
• shellbags::EXTENSION_BLOCK_0XBEEF0004
• shellbags::EXTENSION_BLOCK_0XBEEF0026
• shellbags::MAJOR_CLASS_CLSID
• shellbags::MAJOR_CLASS_COMPRESSED_FOLDER
• shellbags::MAJOR_CLASS_CONTROL_PANEL
• shellbags::MAJOR_CLASS_FILE_ENTRY
• shellbags::MAJOR_CLASS_NETWORK_LOCATION
• shellbags::MAJOR_CLASS_ROOT_FOLDER
• shellbags::MAJOR_CLASS_URI
• shellbags::MAJOR_CLASS_VOLUME
• shellbags::MY_COMPUTER_GUID
• shellbags::NTUSER_BAGMRU_PATH
• shellbags::NTUSER_BAGS_PATH
• shellbags::USRCLASS_BAGMRU_PATH
• shellbags::USRCLASS_BAGS_PATH
• shlink::EXTRA_CONSOLE_DATA_BLOCK
• shlink::EXTRA_CONSOLE_FE_DATA_BLOCK
• shlink::EXTRA_DARWIN_DATA_BLOCK
• shlink::EXTRA_DATA_TERMINAL_BLOCK_SIZE
• shlink::EXTRA_ENVIRONMENT_VARIABLE_DATA_BLOCK
• shlink::EXTRA_ICON_ENVIRONMENT_DATA_BLOCK
• shlink::EXTRA_KNOWN_FOLDER_DATA_BLOCK
• shlink::EXTRA_PROPERTY_STORE_DATA_BLOCK
• shlink::EXTRA_SHIM_DATA_BLOCK
• shlink::EXTRA_SPECIAL_FOLDER_DATA_BLOCK
• shlink::EXTRA_TRACKER_DATA_BLOCK
• shlink::EXTRA_VISTA_AND_ABOVE_ID_LIST_DATA_BLOCK
• shlink::FILETIME_FIELD_SIZE
• shlink::FILE_ATTRIBUTE_ARCHIVE
• shlink::FILE_ATTRIBUTE_COMPRESSED
• shlink::FILE_ATTRIBUTE_DIRECTORY
• shlink::FILE_ATTRIBUTE_ENCRYPTED
• shlink::FILE_ATTRIBUTE_HIDDEN
• shlink::FILE_ATTRIBUTE_NORMAL
• shlink::FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
• shlink::FILE_ATTRIBUTE_OFFLINE
• shlink::FILE_ATTRIBUTE_READONLY
• shlink::FILE_ATTRIBUTE_REPARSE_POINT
• shlink::FILE_ATTRIBUTE_SPARSE_FILE
• shlink::FILE_ATTRIBUTE_SYSTEM
• shlink::FILE_ATTRIBUTE_TEMPORARY
• shlink::HEADER_SIZE
• shlink::LINK_CLSID
• shlink::LINK_FLAG_ALLOW_LINK_TO_LINK
• shlink::LINK_FLAG_DISABLE_KNOWN_FOLDER_ALIAS
• shlink::LINK_FLAG_DISABLE_KNOWN_FOLDER_TRACKING
• shlink::LINK_FLAG_DISABLE_LINK_PATH_TRACKING
• shlink::LINK_FLAG_ENABLE_TARGET_METADATA
• shlink::LINK_FLAG_FORCE_NO_LINK_INFO
• shlink::LINK_FLAG_FORCE_NO_LINK_TRACK
• shlink::LINK_FLAG_HAS_ARGUMENTS
• shlink::LINK_FLAG_HAS_DARWIN_ID
• shlink::LINK_FLAG_HAS_EXP_ICON
• shlink::LINK_FLAG_HAS_EXP_STRING
• shlink::LINK_FLAG_HAS_ICON_LOCATION
• shlink::LINK_FLAG_HAS_LINK_INFO
• shlink::LINK_FLAG_HAS_LINK_TARGET_ID_LIST
• shlink::LINK_FLAG_HAS_NAME
• shlink::LINK_FLAG_HAS_RELATIVE_PATH
• shlink::LINK_FLAG_HAS_WORKING_DIR
• shlink::LINK_FLAG_IS_UNICODE
• shlink::LINK_FLAG_KEEP_LOCAL_ID_LIST_FOR_UNC_TARGET
• shlink::LINK_FLAG_NO_PIDL_ALIAS
• shlink::LINK_FLAG_PREFER_ENVIRONMENT_PATH
• shlink::LINK_FLAG_RUN_AS_USER
• shlink::LINK_FLAG_RUN_IN_SEPARATE_PROCESS
• shlink::LINK_FLAG_RUN_WITH_SHIM_LAYER
• shlink::LINK_FLAG_UNALIAS_ON_SAVE
• shlink::OFFSET_ACCESS_TIME
• shlink::OFFSET_CREATION_TIME
• shlink::OFFSET_WRITE_TIME
• sqlite::SQLITE_DB_SIZE_OFFSET
• sqlite::SQLITE_FREELIST_COUNT_OFFSET
• sqlite::SQLITE_FREELIST_TRUNK_OFFSET
• sqlite::SQLITE_HEADER_SIZE
• sqlite::SQLITE_PAGE_SIZE_OFFSET
• sqlite::SQLITE_RESERVED_SPACE_OFFSET
• sqlite::SQLITE_TEXT_ENCODING_OFFSET
• sqlite::SQLITE_WAL_FRAME_HEADER_SIZE
• sqlite::SQLITE_WAL_HEADER_SIZE
• srum::TABLE_APP_RESOURCE_USAGE
• srum::TABLE_APP_TIMELINE
• srum::TABLE_ENERGY_USAGE
• srum::TABLE_ENERGY_USAGE_LT
• srum::TABLE_ID_MAP
• srum::TABLE_NETWORK_CONNECTIVITY
• srum::TABLE_NETWORK_USAGE
• srum::TABLE_PUSH_NOTIFICATIONS
• srum::TABLE_VFUPROV
• temporal::FILETIME_EPOCH_OFFSET
• temporal_formats::COCOA_EPOCH_NS
• temporal_formats::DISCORD_EPOCH_NS
• temporal_formats::DOTNET_EPOCH_NS
• temporal_formats::FILETIME_EPOCH_NS
• temporal_formats::HFS_EPOCH_NS
• temporal_formats::JULIAN_EPOCH_NS
• temporal_formats::KSUID_EPOCH_NS
• temporal_formats::MJD_EPOCH_NS
• temporal_formats::OLE_EPOCH_NS
• temporal_formats::POSTGRES_EPOCH_NS
• temporal_formats::SONY_EPOCH_NS
• temporal_formats::SQLSERVER_EPOCH_NS
• temporal_formats::TWITTER_EPOCH_NS
• third_party::CHROME_PATHS
• third_party::DROPBOX_PATHS
• third_party::KITTY_PATHS
• third_party::ONEDRIVE_PATHS
• third_party::PUTTY_PATHS
• third_party::WINRAR_PATHS
• third_party::WINSCP_PATHS
• threat_intel::signals::ARTIFACT_LD_PRELOAD_FOREIGN
• threat_intel::signals::ARTIFACT_LD_PRELOAD_IN_HASH_LIST
• threat_intel::signals::ARTIFACT_PAM_STAGING_FATHER
• threat_intel::signals::ARTIFACT_PAM_STAGING_STRUCTURAL
• threat_intel::signals::ELF_GLOBALLY_LOADED
• threat_intel::signals::ELF_HOOKS_FILE_HIDING
• threat_intel::signals::ELF_HOOKS_IO_INTERCEPTION
• threat_intel::signals::ELF_HOOKS_NETWORK_HIDING
• threat_intel::signals::ELF_HOOKS_PAM_CREDENTIAL
• threat_intel::signals::ELF_HOOKS_PROCESS_HIDING
• threat_intel::signals::ELF_HOOKS_UID_SPOOFING
• threat_intel::signals::ELF_LIBC_SHADOW_EXPORTS
• threat_intel::signals::ELF_NOT_IN_PKG_DB
• threat_intel::signals::ELF_STRING_FATHER_FORMAT
• threat_intel::signals::ELF_STRING_STAGING_PATH
• threat_intel::signals::NETWORK_MAGIC_PACKET_KNOCK
• threat_intel::signals::NETWORK_REVERSE_SHELL
• threat_intel::signals::NETWORK_SSH_STRATUM_TUNNEL
• threat_intel::signals::NETWORK_STRATUM_CONNECTION
• threat_intel::signals::NETWORK_STRATUM_LISTEN
• threat_intel::signals::PROCESS_ANOMALOUS_THREAD_COUNT
• threat_intel::signals::PROCESS_HIDDEN_FROM_PS
• threat_intel::signals::PROCESS_MASQUERADE
• threat_intel::signals::PROCESS_SHELL_UPGRADE_CHAIN
• threat_intel::signals::PROCESS_THREAD_MINER_GENERIC
• threat_intel::signals::PROCESS_THREAD_MINER_XMRIG
• threat_intel::signals::SIGNAL_META
• threat_intel::signals::SYSTEM_CPU_ANOMALY_HIGH
• threat_intel::signals::SYSTEM_KERNEL_TAINT_FORCED
• threat_intel::signals::SYSTEM_KERNEL_TAINT_OOT
• threat_intel::signals::SYSTEM_LD_PRELOAD_SET
• threat_intel::signals::SYSTEM_PROC_MODULES_SUSPECT
• threat_intel::signals::TEMPORAL_ACTIVATION_SEQUENCE
• threat_intel::signals::TEMPORAL_LDPRELOAD_SSHD_RESTART
• timelining::BODYFILE_FIELDS
• timestamp_artifacts::ARTIFACT_TIMESTAMPS
• toolchain::VOLATILITY3_ISF_SERVER
• vhd::CURRENT_VERSION
• vhd::DISK_TYPE_DIFFERENCING
• vhd::DISK_TYPE_DYNAMIC
• vhd::DISK_TYPE_FIXED
• vhd::DYNAMIC_HEADER_COOKIE
• vhd::DYNAMIC_HEADER_SIZE
• vhd::FIXED_DATA_OFFSET
• vhd::FOOTER_COOKIE
• vhd::FOOTER_OFFSETS
• vhd::FOOTER_SIZE
• vhdx::CRC32C_POLYNOMIAL
• vhdx::FILE_IDENTIFIER
• vhdx::FILE_IDENTIFIER_OFFSET
• vhdx::HEADER1_OFFSET
• vhdx::HEADER2_OFFSET
• vhdx::HEADER_SIGNATURE
• vhdx::HEADER_SIZE
• vhdx::PAYLOAD_BLOCK_FULLY_PRESENT
• vhdx::PAYLOAD_BLOCK_NOT_PRESENT
• vhdx::PAYLOAD_BLOCK_PARTIALLY_PRESENT
• vhdx::PAYLOAD_BLOCK_UNDEFINED
• vhdx::PAYLOAD_BLOCK_UNMAPPED
• vhdx::PAYLOAD_BLOCK_ZERO
• vhdx::REGION_GUIDS
• vhdx::REGION_TABLE1_OFFSET
• vhdx::REGION_TABLE2_OFFSET
• vhdx::REGION_TABLE_SIGNATURE
• vmdk::COMPRESSION_DEFLATE
• vmdk::COMPRESSION_NONE
• vmdk::COWD_GRAIN_DIRECTORY_SECTOR
• vmdk::COWD_GTES_PER_GRAIN_TABLE
• vmdk::COWD_HEADER_OFFSETS
• vmdk::COWD_MAGIC
• vmdk::CREATE_TYPES
• vmdk::EXTENT_ACCESS_MODES
• vmdk::EXTENT_TYPES
• vmdk::GD_AT_END
• vmdk::GRAIN_MARKER_HEADER_SIZE
• vmdk::GRAIN_MARKER_OFFSETS
• vmdk::GTE_SPARSE
• vmdk::GTE_ZEROED
• vmdk::SECTOR_SIZE
• vmdk::SESPARSE_CONST_MAGIC
• vmdk::SESPARSE_GD_ALLOC_FLAG
• vmdk::SESPARSE_GD_ALLOC_MASK
• vmdk::SESPARSE_GD_INDEX_MASK
• vmdk::SESPARSE_GRAIN_SECTORS
• vmdk::SESPARSE_GRAIN_TABLE_SECTORS
• vmdk::SESPARSE_GTES_PER_GRAIN_TABLE
• vmdk::SESPARSE_GTE_ALLOCATED
• vmdk::SESPARSE_GTE_SCSI_UNMAPPED
• vmdk::SESPARSE_GTE_TYPE_MASK
• vmdk::SESPARSE_GTE_UNALLOCATED
• vmdk::SESPARSE_GTE_ZERO
• vmdk::SESPARSE_HEADER_OFFSETS
• vmdk::SESPARSE_VERSION
• vmdk::SESPARSE_VOLATILE_MAGIC
• vmdk::VERSION_BASE
• vmdk::VERSION_STREAM_OPTIMIZED
• vmdk::VERSION_ZEROED_GRAIN
• vmdk::VMDK4_FLAG_COMPRESSED
• vmdk::VMDK4_FLAG_MARKERS
• vmdk::VMDK4_FLAG_USE_RGD
• vmdk::VMDK4_FLAG_VALID_NEWLINE
• vmdk::VMDK4_FLAG_ZERO_GRAIN
• vmdk::VMDK4_HEADER_OFFSETS
• vmdk::VMDK4_MAGIC