This class is used to parse indicators from a STIX2 file and provide functions to compare extracted artifacts to the indicators.

This module extracts all SMS messages containing links.

Command to check Android Intrusion Logging files.

This module extracts records from the TCC.db SQLite database.

This module extracts data from get properties.

Parser for dumpsys dattery daily updates.

Parser for Android tombstone crash files. This parser can parse both text and protobuf tombstone crash files.

Exception raised file parsing an android backup file

This module extracts all calendar entries.

This class extracts data from DataUsage.sqlite and attempts to identify any suspicious processes if running on a full filesystem dump.

This class provides functions to decrypt an encrypted iTunes backup using either a password or a key file.

Parser for dumpsys app ops info

Parser for dumpsys dattery history events.

Parser for dumpsys DBInfo service

Parser for uninstalled apps listed in platform_compat section.

Parser for dumpsys receivers in the package section

This module extracts creation and modification date of files from a full file-system dump.

Base class for modules analyzing intrusion logs (newline-delimited JSON). Performance note ---------------- Log files can be large and ar

This module extracts information from a backup Manifest.db file.

This module analyzes root_binaries.json for root binaries found by androidqf.

This module extracts all Safari browser state records.

This module analyzes the files.json dump generated by AndroidQF. The format needs to be kept in sync with the AndroidQF module code. htt

This module examines the installed packages in packages.json

This module analyse running processes

This module analyse setting files

This module extracts information from the private/var/Keychains/Analytics/*.db files.

This module extracts information about the device and the backup.

This module extracts Global Preferences to check if Lockdown mode is enabled.

This class provides a base for all iOS filesystem/backup extraction modules.

This artifact parses mount information from /proc/mounts or similar mount data. It can detect potentially suspicious mount configurations tha

This module extracts records from WebKit ResourceLoadStatistics observations.db.

This module creates timeline for log files extracted by AQF.

This module leverages the Analytics module in order to extract a timeline of build numbers from the private/var/Keychains/Analytics/*.db files

This class provides a base for all Android Data analysis modules.

Extract information from accounts installed on the phone.

Base class for artifacts. XXX: Inheriting from MVTModule to have the same signature as other modules. Not sure if this is a good idea.

This class provides a base for all backup extractios modules

This class provides a base for all Android Bug Report modules.

This module extracts records from battery daily updates.

This module extracts phone calls details

This module extracts all Chrome favicon records.

This module extracts all Chome visits.

This module extracts the full plist data from configuration profiles.

This module analyzes network connection events from intrusion logs.

This module extracts all contact details from the phone's address book.

NOTE TO OEMS: If you add custom fields to this proto, do not use numbers in the reserved range.

Custom JSON encoder to handle non-standard types. Some modules are storing non-UTF-8 bytes in their results dictionaries. This causes ex

This module analyzes DNS events from intrusion logs.

This module extracts ADB key info.

This module extracts stats on accessibility.

This module extracts details on receivers for risky activities.

This module extracts information on package from App-Ops Manager.

This module extracts records from battery daily updates.

This module extracts records from battery daily updates.

This module extracts records from battery daily updates.

This module extracts device properties from getprop command.

This module extracts details on receivers for risky activities.

This module extracts details on uninstalled apps.

This module extracts details on receivers for risky activities.

This module extracts all Firefox favicon

This module extracts all Firefox visits and tries to detect potential network injection attacks.