Skip to content

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

License

tclahr/uac

master
Switch branches/tags
Code

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
bin
 
 
 
 
lib
 
 
 
 
 
 
 
 
 
 
 
 
 
 
uac
 
 

Unix-like Artifacts Collector

ShellCheck CII Best Practices GitHub release (latest by date including pre-releases) GitHub

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.

DocumentationMain FeaturesSupported Operating SystemsUsing UACContributingSupportLicense

Imgur


📘 Documentation

Project documentation page: https://tclahr.github.io/uac-docs


🌟 Main Features

  • Runs everywhere with no dependencies (no installation required).
  • Customizable and extensible collections and artifacts.
  • Respects the order of volatility during artifacts collection.
  • Collects information from processes running without a binary on disk.
  • Extracts information from files and directories to create a bodyfile (including enhanced file attributes for ext4).
  • Hashes running processes and executable files.
  • Collects user and system configuration files and logs.
  • Collects artifacts from applications.
  • Acquires volatile memory from Linux systems using Microsoft's avml tool.

💾 Supported Operating Systems

UAC runs on any Unix-like system (regardless the processor architecture). All UAC needs is shell :)

AIX Android ESXi FreeBSD Linux macOS NetBSD NetScaler OpenBSD Solaris

Note that UAC even runs on systems like Network Attached Storage (NAS) devices, Network devices such as OpenWrt, and IoT devices.


🚀 Using UAC

UAC does not need to be installed on the target system. You only need to download the latest version from the releases page, uncompress and run it. As simple as that!

A profile name and/or a list of artifacts, and the destination directory need to be provided in order to run a collection. The remaining parameters are optional.

Common usage scenarios may include the following:

Collect all artifacts based on the full profile, and create the output file in /tmp.

./uac -p full /tmp

Collect all live_response, and the bodyfile/bodyfile.yaml artifact, and create the output file in the current directory.

./uac -a live_response/\*,bodyfile/bodyfile.yaml .

Collect all artifacts based on the full profile, but excludes the bodyfile/bodyfile.yaml artifact, and create the output file in /tmp.

./uac -p full -a \!bodyfile/bodyfile.yaml /tmp

Note that when a profile and a list of artifacts are provided, the artifacts from the profile will always be collected first, even if the parameter -a was provided before -p in the command line. In the example below, the memory_dump/avml.yaml artifact will only be collected after all artifacts from full profile were collected.

./uac -a memory_dump/avml.yaml -p full /tmp

Collect all artifacts based on the full profile, but limiting the data collection based on the date range provided.

./uac -p full /tmp --date-range-start 2021-05-01 --date-range-end 2021-08-31

Collect all but live response artifacts from a Linux disk image mounted in /mnt/ewf.

./uac -p full -a \!live_response/\* /tmp --mount-point /mnt/ewf --operating-system linux

Please check the project documentation page for more information about command line options, how to create your own artifacts, profiles, and more!


💙 Contributing

Have you created your own artifact files? Please share them with us!

You can contribute with new artifacts, profiles, bug fixes or even proposing new features. Please read our Contributing Guide before submitting a Pull Request to the project.


👨‍💻 Community Support

For general help using UAC, please refer to the project documentation page. For additional help, you can use one of the channels to ask a question:

  • Discord (For live discussion with the community and UAC team)
  • GitHub (Bug reports and contributions)
  • Twitter (Get the news fast)

📜 License

The UAC project uses the Apache License Version 2.0 software license.

About

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Topics

Resources

License

Code of conduct

Stars

Watchers

Forks