tclahr / uac

Unix-like Artifacts Collector

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.

Documentation • Main Features • Supported Operating Systems • Using UAC • Contributing • Support • License

📘 Documentation

Project documentation page: https://tclahr.github.io/uac-docs

🌟 Main Features

• Runs everywhere with no dependencies (no installation required).
• Customizable and extensible collections and artifacts.
• Respects the order of volatility during artifacts collection.
• Collects information from processes running without a binary on disk.
• Extracts information from files and directories to create a bodyfile (including enhanced file attributes for ext4).
• Hashes running processes and executable files.
• Collects user and system configuration files and logs.
• Collects artifacts from applications.
• Acquires volatile memory from Linux systems using Microsoft's avml tool.

💾 Supported Operating Systems

UAC runs on any Unix-like system (regardless of the processor architecture). All UAC needs is shell :)

Note that UAC even runs on systems like Network Attached Storage (NAS) devices, Network devices such as OpenWrt, and IoT devices.

🚀 Using UAC

UAC does not need to be installed on the target system. You only need to download the latest version from the releases page, uncompress and run it. As simple as that!

A profile name and/or a list of artifacts, and the destination directory need to be provided to run a collection. The remaining parameters are optional.

Common usage scenarios may include the following:

Collect all artifacts based on the full profile, and create the output file in /tmp.

./uac -p full /tmp

Collect all live_response, and the bodyfile/bodyfile.yaml artifact, and create the output file in the current directory.

./uac -a live_response/\*,bodyfile/bodyfile.yaml .

Collect all artifacts based on the full profile, but excludes the bodyfile/bodyfile.yaml artifact, and create the output file in /tmp.

./uac -p full -a \!bodyfile/bodyfile.yaml /tmp

Collect the memory dump, then all artifacts based on the full profile.

./uac -a memory_dump/avml.yaml -p full /tmp

Collect the memory dump, then all artifacts based on the ir_triage profile excluding the bodyfile/bodyfile.yaml artifact.

./uac -a memory_dump/avml.yaml -p ir_triage -a \!bodyfile/bodyfile.yaml /tmp

Collect all artifacts based on the full profile, but limit the data collection based on the date range provided.

./uac -p full /tmp --date-range-start 2021-05-01 --date-range-end 2021-08-31

Collect all but live response artifacts from a Linux disk image mounted in /mnt/ewf.

./uac -p full -a \!live_response/\* /tmp --mount-point /mnt/ewf --operating-system linux

Please check the project documentation page for more information about command line options, how to create your own artifacts, profiles, and more!

💙 Contributing

Have you created your own artifact files? Please share them with us!

You can contribute with new artifacts, profiles, bug fixes or even propose new features. Please read our Contributing Guide before submitting a Pull Request to the project.

👨‍💻 Community Support

For general help using UAC, please refer to the project documentation page. For additional help, you can use one of the channels to ask a question:

• Discord (For live discussion with the community and UAC team)
• GitHub (Bug reports and contributions)
• Twitter (Get the news fast)

📜 License

The UAC project uses the Apache License Version 2.0 software license.