Unix-like Artifacts Collector: Live Response collection tool for Incident Reponse
UAC (Unix-like Artifacts Collector)
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.
Main Features
- Run everywhere with no dependencies (no installation required).
- Customizable and extensible collections and artifacts.
- Respect the order of volatility during artifact collection.
- Collect information from processes running without a binary on disk.
- Hash running processes and executable files.
- Extract information from files and directories to create a bodyfile (including enhanced file attributes for ext4).
- Collect user and system configuration files and logs.
- Collect artifacts from applications.
- Acquire volatile memory from Linux systems using different methods and tools.
Use
Copyright (C) 2020 tclahr
