dissect.target.plugins.apps.remoteaccess.anydesk

Module Contents

Classes

AnydeskPlugin

Anydesk plugin.
class dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin(target)

Bases: dissect.target.plugins.apps.remoteaccess.remoteaccess.RemoteAccessPlugin

Anydesk plugin.

__namespace__ = 'anydesk'

Defines the plugin namespace.

SERVICE_GLOBS = ['sysvol/ProgramData/AnyDesk/*.trace', 'sysvol/ProgramData/AnyDesk/ad_*/*.trace',...
USER_GLOBS = ['AppData/Roaming/AnyDesk/*.trace', 'AppData/Roaming/AnyDesk/ad_*/*.trace',...
RemoteAccessLogRecord
trace_files: set[tuple[dissect.target.helpers.fsutil.TargetPath, dissect.target.plugins.general.users.UserDetails]]
check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

logs() → Iterator[RemoteAccessLogRecord]

Parse AnyDesk trace files.

AnyDesk is a remote desktop application and can be used by adversaries to get (persistent) access to a machine. Log files (.trace files) can be stored on various locations, based on target OS and client type. Timestamps in trace files do not carry a time zone designator (TZD) but are in fact UTC.

References