Security
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.
Documentation • Main Features • Supported Operating Systems • Using UAC • Contributing • Support • License
Project documentation page: https://tclahr.github.io/uac-docs
UAC runs on any Unix-like system (regardless of the processor architecture). All UAC needs is shell :)
Note that UAC even runs on systems like Network Attached Storage (NAS) devices, Network devices such as OpenWrt, and IoT devices.
UAC does not need to be installed on the target system. You only need to download the latest version from the releases page, uncompress and run it. As simple as that!
A profile name and/or a list of artifacts, and the destination directory need to be provided to run a collection. The remaining parameters are optional.
Full Disk Access permission is a privacy feature introduced in macOS Mojave (10.14) that prevents some applications from accessing important data, such as Mail, Messages, and Safari files. So it is strongly recommended that you manually grant permission for Terminal application before running UAC from the terminal, or grant permission for remote users before running UAC via ssh.
Common usage scenarios may include the following:
Collect all artifacts based on the full
profile, and create the output file in /tmp
.
./uac -p full /tmp
Collect all live_response
, and the bodyfile/bodyfile.yaml
artifact, and create the output file in the current directory.
./uac -a live_response/\*,bodyfile/bodyfile.yaml .
Collect all artifacts based on the full
profile, but exclude the bodyfile/bodyfile.yaml
artifact, and create the output file in /tmp
.
./uac -p full -a \!bodyfile/bodyfile.yaml /tmp
Collect the memory dump, then all artifacts based on the full
profile.
./uac -a artifacts/memory_dump/avml.yaml -p full /tmp
Collect the memory dump, then all artifacts based on the ir_triage
profile excluding the bodyfile/bodyfile.yaml
artifact.
./uac -a ./artifacts/memory_dump/avml.yaml -p ir_triage -a \!artifacts/bodyfile/bodyfile.yaml /tmp
Collect all artifacts based on the full
profile, but limit the data collection based on the date range provided.
./uac -p full /tmp --date-range-start 2021-05-01 --date-range-end 2021-08-31
Collect all but live response artifacts from a Linux disk image mounted in /mnt/ewf
.
./uac -p full -a \!live_response/\* /tmp --mount-point /mnt/ewf --operating-system linux
Please check the project documentation page for more information about command line options, how to create your own artifacts, profiles, and more!
Have you created any artifact files? Please share them with us!
You can contribute with new artifacts, profiles, bug fixes or even propose new features. Please read our Contributing Guide before submitting a Pull Request to the project.
For general help using UAC, please refer to the project documentation page. For additional help, you can use one of the channels to ask a question:
The UAC project uses the Apache License Version 2.0 software license.