dissect.target 3.17.dev37__tar.gz → 3.18.dev2__tar.gz

{dissect_target-3.17.dev37/dissect.target.egg-info → dissect_target-3.18.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.17.dev37
+Version: 3.18.dev2
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/exceptions.py

@@ -114,3 +114,7 @@ class RegistryCorruptError(RegistryError):
 
 class ConfigurationParsingError(Error):
     """An error occurred during configuration parsing."""
+
+
+class TargetPathNotFoundError(TargetError):
+    """The path to the target does not exist."""

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/loaders/raw.py

@@ -1,6 +1,7 @@
 from pathlib import Path
 
 from dissect.target import container
+from dissect.target.exceptions import TargetPathNotFoundError
 from dissect.target.loader import Loader
 from dissect.target.target import Target
 
@@ -8,6 +9,12 @@ from dissect.target.target import Target
 class RawLoader(Loader):
     """Load raw container files such as disk images."""
 
+    def __init__(self, path: Path, **kwargs):
+        if not path.exists():
+            raise TargetPathNotFoundError("Provided target path does not exist")
+
+        super().__init__(path, **kwargs)
+
     @staticmethod
     def detect(path: Path) -> bool:
         return not path.is_dir()

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/av/mcafee.py

@@ -71,6 +71,9 @@ class McAfeePlugin(Plugin):
         """Return msc log history records from McAfee.
 
         Yields McAfeeMscLogRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/av/sophos.py

@@ -56,6 +56,9 @@ class SophosPlugin(Plugin):
         """Return alert log records from Sophos Hitman Pro/Alert.
 
         Yields HitmanAlertRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp.
             alert (string): Type of Alert.
             description (string): Short description of the alert.
@@ -85,6 +88,9 @@ class SophosPlugin(Plugin):
         """Return log history records from Sophos Home.
 
         Yields SophosLogRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp.
             description (string): Short description of the alert.
             path (path): Path to the infected file (if available).

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/av/symantec.py

@@ -293,6 +293,9 @@ class SymantecPlugin(Plugin):
         """Return log records.
 
         Yields SEPLogRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp associated with the event.
             virus (string): Name of the virus.
             user (string): Name of the user associated with the event.
@@ -326,6 +329,9 @@ class SymantecPlugin(Plugin):
         """Return log firewall records.
 
         Yields SEPFirewallRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Timestamp associated with the event.
             protocol (string): Protocol name associated with the firewall record.
             local_ip ("net.ipaddress"): Local IP address associated with the event.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/av/trendmicro.py

@@ -71,6 +71,9 @@ class TrendMicroPlugin(Plugin):
         """Return Trend Micro Worry-free log history records.
 
         Yields TrendMicroWFLogRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.
@@ -94,6 +97,9 @@ class TrendMicroPlugin(Plugin):
         """Return Trend Micro Worry-free firewall log history records.
 
         Yields TrendMicroWFFirewallRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/browser/chromium.py

@@ -148,6 +148,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts (datetime): Visit timestamp.
                 browser (string): The browser from which the records are generated from.
@@ -209,6 +212,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_created (datetime): Cookie created timestamp.
                 ts_last_accessed (datetime): Cookie last accessed timestamp.
@@ -284,6 +290,9 @@ class ChromiumMixin:
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_start (datetime): Download start timestamp.
                 ts_end (datetime): Download end timestamp.
@@ -344,6 +353,9 @@ class ChromiumMixin:
             browser_name (str): Name of the browser to scan for extensions.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_install (datetime): Extension install timestamp.
                 ts_update (datetime): Extension update timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/browser/firefox.py

@@ -132,6 +132,9 @@ class FirefoxPlugin(BrowserPlugin):
         """Return browser history records from Firefox.
 
         Yields BrowserHistoryRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Visit timestamp.
             browser (string): The browser from which the records are generated from.
             id (string): Record ID.
@@ -193,6 +196,9 @@ class FirefoxPlugin(BrowserPlugin):
             browser_name: The name of the browser as a string.
 
         Yields:
+
+        .. code-block:: text
+
             Records with the following fields:
                 ts_created (datetime): Cookie created timestamp.
                 ts_last_accessed (datetime): Cookie last accessed timestamp.
@@ -232,6 +238,9 @@ class FirefoxPlugin(BrowserPlugin):
         """Return browser download records from Firefox.
 
         Yields BrowserDownloadRecord with the following fields:
+
+        .. code-block:: text
+
             ts_start (datetime): Download start timestamp.
             ts_end (datetime): Download end timestamp.
             browser (string): The browser from which the records are generated from.
@@ -315,7 +324,10 @@ class FirefoxPlugin(BrowserPlugin):
     def extensions(self) -> Iterator[BrowserExtensionRecord]:
         """Return browser extension records for Firefox.
 
-        Yields BrowserExtensionRecord with the following fields::
+        Yields BrowserExtensionRecord with the following fields:
+
+        .. code-block:: text
+
             ts_install (datetime): Extension install timestamp.
             ts_update (datetime): Extension update timestamp.
             browser (string): The browser from which the records are generated.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/apps/browser/iexplore.py

@@ -131,6 +131,9 @@ class InternetExplorerPlugin(BrowserPlugin):
         """Return browser history records from Internet Explorer.
 
         Yields BrowserHistoryRecord with the following fields:
+
+        .. code-block:: text
+
             ts (datetime): Visit timestamp.
             browser (string): The browser from which the records are generated from.
             id (string): Record ID.
@@ -183,6 +186,9 @@ class InternetExplorerPlugin(BrowserPlugin):
         """Return browser downloads records from Internet Explorer.
 
         Yields BrowserDownloadRecord with the following fields:
+
+        .. code-block:: text
+
             ts_start (datetime): Download start timestamp.
             ts_end (datetime): Download end timestamp.
             browser (string): The browser from which the records are generated from.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/unix/linux/cmdline.py

@@ -29,6 +29,9 @@ class CmdlinePlugin(Plugin):
         Think of this output as the command line that the process wants you to see.
 
         Yields CmdlineRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The starttime of the process.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/unix/linux/environ.py

@@ -27,6 +27,9 @@ class EnvironPlugin(Plugin):
         the environ(7) variable directly), this plugin will not reflect those changes.
 
         Yields EnvironmentVariableRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The modification timestamp of the processes' environ file.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/unix/linux/processes.py

@@ -29,6 +29,9 @@ class ProcProcesses(Plugin):
         Each ``/proc/[pid]`` subdirectory contains various pseudo-files.
 
         Yields ProcProcessRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The start time of the process.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/unix/linux/sockets.py

@@ -78,6 +78,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the packet sockets and available stats associated with them.
 
         Yields PacketSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (int): The captured protocol i.e. 0003 is ETH_P_ALL
@@ -101,6 +104,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the unix sockets and available stats associated with them.
 
         Yields UnixSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -117,6 +123,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the raw and raw6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -140,6 +149,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the udp and udp6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
@@ -163,6 +175,9 @@ class NetSocketPlugin(Plugin):
         """This plugin yields the tcp and tcp6 sockets and available stats associated with them.
 
         Yields NetSocketRecord with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/unix/log/atop.py

@@ -270,6 +270,9 @@ class AtopPlugin(Plugin):
             - https://diablohorn.com/2022/11/17/parsing-atop-files-with-python-dissect-cstruct/
 
         Yields AtopRecord with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             process (string): The process name.
             cmdline (string): The command-line of the process.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/activitiescache.py

@@ -77,6 +77,9 @@ class ActivitiesCachePlugin(Plugin):
             - https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/
 
         Yields ActivitiesCacheRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             start_time (datetime): StartTime field.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/catroot.py

@@ -105,6 +105,9 @@ class CatrootPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
 
         Yields CatrootRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             digest (digest): The parsed digest.
@@ -210,6 +213,9 @@ class CatrootPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files
 
         Yields CatrootRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             digest (digest): The parsed digest.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/lnk.py

@@ -51,6 +51,9 @@ class LnkPlugin(Plugin):
         """Parse all .lnk files in /ProgramData, /Users, and /Windows or from a specified path in record format.
 
         Yields a LnkRecord record with the following fields:
+
+        .. code-block:: text
+
             lnk_path (path): Path of the link (.lnk) file.
             lnk_name (string): Name of the link (.lnk) file.
             lnk_mtime (datetime): Modification time of the link (.lnk) file.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/log/etl.py

@@ -122,6 +122,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.
@@ -140,6 +143,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.
@@ -157,6 +163,9 @@ class EtlPlugin(Plugin):
 
         Yields dynamically created records based on the fields inside an ETL event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/log/evt.py

@@ -125,6 +125,9 @@ class EvtPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
         Yields dynamically created records based on the fields in the event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/log/evtx.py

@@ -47,6 +47,9 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
         Yields dynamically created records based on the fields in the event.
         At least contains the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The TimeCreated_SystemTime field of the event.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/log/pfro.py

@@ -41,6 +41,9 @@ class PfroPlugin(Plugin):
             - https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/
 
         Yields PfroRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The parsed timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/log/schedlgu.py

@@ -129,9 +129,12 @@ class SchedLgUPlugin(Plugin):
 
         Adversaries may use malicious ``.job`` files to gain persistence on a system.
 
-        Yield:
+        Yields SchedLgURecord with fields:
+
+        .. code-block:: text
+
             ts (datetime): The timestamp of the event.
-            job (str): The name of the ``.job`` file.
+            job (str): The name of the .job file.
             command (str): The command executed.
             status (str): The status of the event (finished, completed, exited, stopped).
             exit_code (int): The exit code of the event.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/prefetch.py

@@ -258,6 +258,9 @@ class PrefetchPlugin(Plugin):
             - https://www.geeksforgeeks.org/prefetch-files-in-windows/
 
         Yields PrefetchRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Run timestamp.
@@ -269,6 +272,9 @@ class PrefetchPlugin(Plugin):
         with --grouped:
 
         Yields PrefetchRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Run timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/recyclebin.py

@@ -66,6 +66,9 @@ class RecyclebinPlugin(Plugin):
         Return files located in the recycle bin ($Recycle.Bin).
 
         Yields RecycleBinRecords with fields:
+
+        .. code-block:: text
+
           hostname (string): The target hostname
           domain (string): The target domain
           ts (datetime): The time of deletion

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/appxdebugkeys.py

@@ -86,6 +86,9 @@ class AppxDebugKeysPlugin(Plugin):
             - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
 
         Yields AppXDebugKeyRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/bam.py

@@ -41,6 +41,9 @@ class BamDamPlugin(Plugin):
         """Parse bam and dam registry keys.
 
         Yields BamDamRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The parsed timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/clsid.py

@@ -55,6 +55,9 @@ class CLSIDPlugin(Plugin):
         HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID.
 
         Yields CLSIDRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): Last modified timestamp of the registry key.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/firewall.py

@@ -26,6 +26,9 @@ class FirewallPlugin(Plugin):
         HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules registry key.
 
         Yields dynamic records with usually the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             key (string): The rule key name.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/muicache.py

@@ -48,6 +48,9 @@ class MuiCachePlugin(Plugin):
             - https://forensafe.com/blogs/muicache.html
 
         Yields MuiCacheRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             index (varint): The index of the entry.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/recentfilecache.py

@@ -45,6 +45,9 @@ class RecentFileCachePlugin(Plugin):
         """Parse RecentFileCache.bcf.
 
         Yields RecentFileCacheRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             path (uri): The parsed path.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/regf.py

@@ -49,6 +49,9 @@ class RegfPlugin(Plugin):
         Yields RegistryKeyRecords and RegistryValueRecords
 
         RegistryKeyRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.
@@ -57,6 +60,9 @@ class RegfPlugin(Plugin):
             source (string): The hive file path.
 
         RegistryValueRecord fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified time.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/runkeys.py

@@ -61,6 +61,9 @@ class RunKeysPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
 
         Yields RunKeyRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The registry key last modified timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/shimcache.py

@@ -318,6 +318,9 @@ class ShimcachePlugin(Plugin):
             - https://www.andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/
 
         Yields ShimcacheRecords with the following fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             last_modified (datetime): The last modified date.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/trusteddocs.py

@@ -61,6 +61,9 @@ class TrustedDocumentsPlugin(Plugin):
 
         Yields records based on the values within the TrustRecords registry keys.
         At least contains the following fields:
+
+        .. code-block:: text
+
             application (string): Application name of the Office product that produced the TrustRecords registry key.
             document_path (path): Path to the document for which a TrustRecords entry is created.
             ts (datetime): The created time of the TrustRecord registry key.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/usb.py

@@ -93,6 +93,9 @@ class UsbPlugin(Plugin):
         HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR registry key.
 
         Yields UsbRegistryRecord with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname
             domain (string): The target domain
             type (string): Type of USB device

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/regf/userassist.py

@@ -72,6 +72,9 @@ class UserAssistPlugin(Plugin):
             - https://www.aldeid.com/wiki/Windows-userassist-keys
 
         Yields UserAssistRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datetime): The entry timestamp.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/sam.py

@@ -356,6 +356,9 @@ class SamPlugin(Plugin):
             - https://en.wikipedia.org/wiki/Security_Account_Manager
 
         Yields SamRecords with fields:
+
+        .. code-block:: text
+
             rid (uint32): The RID.
             fullname (string): Parsed fullname.
             username (string): Parsed username.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/services.py

@@ -72,6 +72,9 @@ class ServicesPlugin(Plugin):
             - https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html
 
         Yields ServiceRecords with fields:
+
+        .. code-block:: text
+
             hostname (string): The target hostname.
             domain (string): The target domain.
             ts (datatime): The last modified timestamp of the registry key.

{dissect_target-3.17.dev37 → dissect_target-3.18.dev2}/dissect/target/plugins/os/windows/wer.py

@@ -155,6 +155,9 @@ class WindowsErrorReportingPlugin(Plugin):
 
         Yields dynamically created records based on the fields in the files. A record at least contains the following
         fields:
+
+        .. code-block:: text
+
             ts (datetime): The moment in time when the error event took place.
             version (string): WER file version.
             event_type (string): WER file event type.