UAC

No entries match these filters. Clear filters

1. v3.4.0 Sep 9, 2026 · issue 069

   UAC v3.4.0 adds 20+ AI coding agent artifact collectors (Claude, Copilot, Codex, Gemini, Cursor and more) plus new macOS and AIX artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.4.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v3.4.0

   └──▷ TRY IT
   Collect forensic artifacts from all AI coding tools on a compromised developer workstation during an IR engagement.
   copy

   $ ./uac -a ./artifacts/files/applications/ai_tools/* -p ir_triage /tmp

   Collect macOS PrivilegedHelperTools to investigate potential persistence mechanisms on a macOS endpoint.
   copy

   $ ./uac -a ./artifacts/files/system/macos_privilegedhelpertools.yaml /tmp

   Collect Trash directory contents across all volumes to recover deleted evidence during a forensic investigation.
   copy

   $ ./uac -a ./artifacts/files/system/trash.yaml /tmp

   • Adds files/applications/ai_tools/amp.yaml to collect Amp session data, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/claude_code.yaml to collect Claude Code session logs, config, credentials, pre-edit file history, tool results, auto-memory, plans, shell snapshots, hook scripts, and IDE lock files [linux, macos].
   • Adds files/applications/ai_tools/claude_desktop.yaml to collect Claude Desktop transcripts, config, credentials, storage, skill/plugin definitions, and app logs [macos].
   • Adds files/applications/ai_tools/codebuff.yaml to collect Codebuff chat logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/codex.yaml to collect OpenAI Codex CLI session logs, config, auth, state/thread-history/log SQLite databases with WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites./SHM sidecars, AGENTS.md, rules, shell snapshots, and installation_id; excludes tmp and cache trees [linux, macos].

   +20 more show less

   • Adds files/applications/ai_tools/copilot.yaml to collect GitHub Copilot CLI OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. usage logs, config, host token/config store, session workspace metadata, plans and checkpoints, session store database with WAL/SHM sidecars and logs, VS Code Copilot Chat conversation transcripts, agent-mode edit snapshots, and extension session store [linux, macos].
   • Adds files/applications/ai_tools/cursor.yaml to collect Cursor global data, IDE settings, workspace state, history, and logs [linux, macos].
   • Adds files/applications/ai_tools/droid.yaml to collect Droid session settings, config, and auth [linux, macos].
   • Adds files/applications/ai_tools/gemini.yaml to collect Gemini CLI chat logs, config, OAuth credentials, custom commands and policies (TOML), GEMINI.md and memory files, and per-project root markers; excludes downloaded binaries, shadow git checkpoints, and the browser profile [linux, macos].
   • Adds files/applications/ai_tools/goose.yaml to collect Goose session database and config [linux, macos].
   • Adds files/applications/ai_tools/hermes.yaml to collect Hermes Agent state database and config [linux, macos].
   • Adds files/applications/ai_tools/kilo.yaml to collect Kilo session database and config [linux, macos].
   • Adds files/applications/ai_tools/kimi.yaml to collect Kimi session wire logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/kiro.yaml to collect Kiro global config, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., agents, steering, prompts, skills, sessions, and CLI/IDE data [linux, macos].
   • Adds files/applications/ai_tools/openclaw.yaml to collect OpenClaw session logs, config, and auth [linux, macos].
   • Adds files/applications/ai_tools/opencode.yaml to collect OpenCode session data, config, credentials, SQLite WALSQLite WALA write-ahead logging mode for SQLite databases where changes are written to a separate log file before the main database, allowing concurrent reads during writes and faster commit performance./SHM sidecars, logs, JSONC config, agent and command definitions, and the state directory; excludes node_modules, cloned repos, and snapshots [linux, macos].
   • Adds files/applications/ai_tools/pi_agent.yaml to collect pi-agent session logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/qwen.yaml to collect Qwen Code chat logs, config, and OAuth credentials [linux, macos].
   • Adds files/system/macos_privilegedhelpertools.yaml to collect macOS PrivilegedHelperTools, which may be used for persistence [macos].
   • Adds files/system/trash.yaml to collect the entire Trash directory contents [freebsd, linux, macos, netbsd, openbsd].
   • Adds live_response/network/rmsock.yaml to identify process ownership for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. network connections, associating PIDs with network activity on AIX systems where lsof is unavailable [aix].
   • Extends live_response/containers/docker.yaml artifact collection to macOS [macos].
   • Extends live_response/network/netstat.yaml to include netstat -Aan [aix].
   • Extends live_response/process/fstat.yaml to include fstat -n [freebsd, netbsd, netscaler, openbsd].
   • Extends live_response/process/ps.yaml to include richer ps -eo output formats with lstart, etime, and pcpu/pmem columns across Linux, macOS, FreeBSD, NetBSD, NetScaler, OpenBSD, AIX, and Solaris.
   • Adds files/applications/ai_tools/amp.yaml to collect Amp session data, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/claude_code.yaml to collect Claude Code session logs, config, credentials, pre-edit file history, tool results, auto-memory, plans, shell snapshots, hook scripts, and IDE lock files [linux, macos].
   • Adds files/applications/ai_tools/claude_desktop.yaml to collect Claude Desktop transcripts, config, credentials, storage, skill/plugin definitions, and app logs [macos].
   • Adds files/applications/ai_tools/codebuff.yaml to collect Codebuff chat logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/codex.yaml to collect OpenAI Codex CLI session logs, config, auth, state/thread-history/log SQLite databases with WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites./SHM sidecars, AGENTS.md, rules, shell snapshots, and installation_id; excludes tmp and cache trees [linux, macos].

   +16 more show less

   • Adds files/applications/ai_tools/copilot.yaml to collect GitHub Copilot CLI OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. usage logs, config, host token/config store, session workspace metadata, plans and checkpoints, session store database with WAL/SHM sidecars and logs, VS Code Copilot Chat conversation transcripts, agent-mode edit snapshots, and extension session store [linux, macos].
   • Adds files/applications/ai_tools/cursor.yaml to collect Cursor global data, IDE settings, workspace state, history, and logs [linux, macos].
   • Adds files/applications/ai_tools/droid.yaml to collect Droid session settings, config, and auth [linux, macos].
   • Adds files/applications/ai_tools/gemini.yaml to collect Gemini CLI chat logs, config, OAuth credentials, custom commands and policies (TOML), GEMINI.md and memory files, and per-project root markers; excludes downloaded binaries, shadow git checkpoints, and the browser profile [linux, macos].
   • Adds files/applications/ai_tools/goose.yaml to collect Goose session database and config [linux, macos].
   • Adds files/applications/ai_tools/hermes.yaml to collect Hermes Agent state database and config [linux, macos].
   • Adds files/applications/ai_tools/kilo.yaml to collect Kilo session database and config [linux, macos].
   • Adds files/applications/ai_tools/kimi.yaml to collect Kimi session wire logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/kiro.yaml to collect Kiro global config, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., agents, steering, prompts, skills, sessions, and CLI/IDE data [linux, macos].
   • Adds files/applications/ai_tools/openclaw.yaml to collect OpenClaw session logs, config, and auth [linux, macos].
   • Adds files/applications/ai_tools/opencode.yaml to collect OpenCode session data, config, credentials, SQLite WALSQLite WALA write-ahead logging mode for SQLite databases where changes are written to a separate log file before the main database, allowing concurrent reads during writes and faster commit performance./SHM sidecars, logs, JSONC config, agent and command definitions, and the state directory; excludes node_modules, cloned repos, and snapshots [linux, macos].
   • Adds files/applications/ai_tools/pi_agent.yaml to collect pi-agent session logs, config, and credentials [linux, macos].
   • Adds files/applications/ai_tools/qwen.yaml to collect Qwen Code chat logs, config, and OAuth credentials [linux, macos].
   • Adds files/system/macos_privilegedhelpertools.yaml to collect macOS PrivilegedHelperTools, which may be used for persistence [macos].
   • Adds files/system/trash.yaml to collect the entire Trash directory contents [freebsd, linux, macos, netbsd, openbsd].
   • Adds live_response/network/rmsock.yaml to identify process ownership for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. network connections, associating PIDs with network activity on AIX systems where lsof is unavailable [aix].

   4 more in Everything

2. v3.3.0 Apr 16, 2026 · release notes

   UAC v3.3.0 adds user-defined variables, per-file command execution, size-based mount exclusions, and a wave of new artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.3.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v3.3.0

   └──▷ TRY IT
   Inject an incident-specific case ID and custom output path into artifact collection without modifying any YAML files.
   copy

   $ uac -p full /evidence/output --define CASE_ID=IR-2024-042 --define COLLECT_PATH=/var/log/app

   Quickly fingerprint a live host's hardware and OS details before deciding which artifact profile to run.
   copy

   $ uac --system-info

   • New --define / -D flag lets you pass user-defined variables on the command line, expanded inside artifacts as %var% or %var=default_value%.
   • New --system-info flag prints CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., memory, hostname, and other system details without running a full collection.
   • The find collector can now run a specified command once for each matched file.
   • New exclude_mount_point_size option in uac.conf skips mount points whose used size exceeds a defined threshold.
   • Artifact fields max_file_size and min_file_size now accept human-readable units: bytes, KB, MB, GB, and TB.

   +14 more show less

   • New statf built-in tool produces bodyfile-format file status output on FreeBSD systems that lack stat and perl.
   • New system/bodyfile2filelists.yaml artifact extracts SUID, SGID, hidden, world-writable, group-writable, and unknown-owner file/directory lists from a previously collected bodyfile.
   • New per-shell artifact files added for ash, bash, dash, elvish, fish, ion, ksh, mksh, nscli (NetScaler), osh, PowerShell, tcsh, xonsh, and zsh history and config collection.
   • New files/ssh/public_keys.yaml collects SSH public keys across all platforms.
   • New ssh/private_keys_with_null_passphrases.yaml collects SSH public keys whose associated private keys have empty passphrases.
   • New Linux artifacts for boot/initramfs/GRUB configs, D-Bus configs, dracut configs, polkit configs, and binfmt_misc handlers — all flagged as possible persistence mechanisms.
   • New macOS artifact files/system/bluetooth.yaml collects cached records of observed Bluetooth devices.
   • New macOS artifact files/system/macos_keychain_devicelist.yaml collects trusted device records from iCloud Keychain's devicelist.db.
   • New macOS artifact files/system/xprotect.yaml collects XProtectXProtectApple's built-in malware detection system for macOS, maintained by Apple and updated silently via XProtect Remediator; cyber tools integrate with or reference it to leverage Apple's own signature-based threat blocking. and MRT versioning metadata.
   • New application artifacts for calc, mail (.mailrc/.mail_aliases), nano, Python, screen, sqlite history/config, and Jenkins config.xml/build.xml files.
   • Browser affiliation database files now collected for Brave, Chrome, Chromium, Edge, Opera, Safari, and Vivaldi on Linux and macOS.
   • Azure Storage upload now automatically appends output and log file names to the SAS URL, eliminating the need for a separate log-file URL.
   • live_response/network/ss.yaml updated to capture PACKET sockets, classic BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. filters, and process name/PID per socket on Linux.
   • memory_dump/avml.yaml updated to also collect vmlinux* and System.map* files to aid Volatility profile building, and exposes an avml_max_memory variable to override the 256 GB memory cap.

   19 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --azure-storage-sas-url-log-file option has been removed; the log file name is now appended automatically to the URL given in --azure-storage-sas-url.
   • !files/applications/imessage.yaml is renamed to files/applications/messages.yaml; any profile or script referencing the old name will no longer match.
   • !files/shell/config.yaml, files/shell/history.yaml, and files/shell/sessions.yaml are replaced by per-shell YAML files (e.g., files/shell/bash.yaml, files/shell/zsh.yaml); custom profiles referencing the old artifact paths will no longer match.
3. v3.2.0 Aug 13, 2025 · release notes

   UAC v3.2.0 adds AWS Sig v4 S3 transfers, OS-specific config overrides, symlink collection by default, and new forensic artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.2.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v3.2.0

   └──▷ TRY IT
   Transfer collected evidence to S3 using the now-supported AWS Signature Version 4, with a presigned URL injected at runtime via an environment variable.
   copy

   $ uac -p full /tmp/uac-output --aws-s3-presigned-url '%env:UAC_S3_URL%' --aws-s3-presigned-url-log-file '%env:UAC_S3_LOG_URL%'

   Run a full collection over SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel., setting multiple SSH options (e.g., strict host key checking off and a custom identity file) using the renamed flag.
   copy

   $ uac -p full /tmp/uac-output --sftp-server user@host:/evidence --sftp-ssh-option StrictHostKeyChecking=no --sftp-ssh-option IdentityFile=/path/to/key

   • Supports AWS Signature Version 4 (AWS4-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.) for Amazon S3 output file transfers.
   • Adds runtime variable support for --aws-s3-presigned-url, --aws-s3-presigned-url-log-file, --azure-storage-sas-url, and --azure-storage-sas-url-log-file.
   • Enables OS-specific configuration overrides by placing files named after the OS in the config directory.
   • Bundles timeout.sh in the bin directory, providing a portable timeout command equivalent across all supported operating systems.
   • Now collects both regular files and symbolic links by default when file_type is not specified in an artifact.

   +13 more show less

   • Adds new files/applications/google_drive.yaml artifact for Google Drive metadata databases and log files [macOS].
   • Adds new files/browsers/cache.yaml artifact for browser cache data [FreeBSD, Linux, macOS] (disabled by default in all profiles).
   • Adds new files/system/vyatta.yaml artifact for Vyatta and VyOS configuration files [Linux].
   • Adds live_response/modifiers/disable_ftrace.yaml modifier to disable ftrace and prevent syscall hooking by LKM rootkits [Linux].
   • Adds live_response/system/loginctl.yaml artifact for terse runtime status of each user via loginctl [Linux].
   • Adds live_response/system/utmpdump.yaml artifact for utmp and wtmp (including log-rotated) files via utmpdump [Linux].
   • Adds live_response/system/show.yaml artifact for consolidated tech-support reports from Vyatta and VyOS systems [Linux].
   • Extends /proc/modules collection in live_response/process/procfs_information.yaml [AIX, FreeBSD, Linux, NetBSD, NetScaler, Solaris].
   • Adds new osquery queries for apt_sources, deb_packages, shell_history, system_controls, logged_in_users, and last_logins [Linux].
   • Extends files/system/user_accounts.yaml to collect macOS login history recovered from .plist files.
   • Updates --validate-artifact to verify that f is included in file_type when max_file_type or min_file_type is specified.
   • Extends mdatp artifact support to include macOS.
   • Renames --sftp-ssh-options to --sftp-ssh-option, now accepting key=value pairs and usable multiple times for multiple SSH options.

   18 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --sftp-ssh-options flag is renamed to --sftp-ssh-option; any script or config using --sftp-ssh-options will break on upgrade.
4. v3.1.0 Mar 20, 2025 · release notes

   UAC v3.1.0 adds rootkit detection via debugfs/xfs_db, an offline IR triage profile, OSQuery integration, and dozens of new Linux/BSD artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   • Adds collection of hidden /etc/ld.so.preload using debugfs and xfs_db to surface stealthy Linux rootkit indicators.
   • Introduces offline_ir_triage profile for offline triage collections.
   • Adds OSQuery artifact collection via osqueryi binary placed in the bin directory (Linux).
   • Adds artifact to list immutable files on Linux systems (live_response/system/immutable_files.yaml).
   • Adds live_response/packages/package_owns_file.yaml to determine which installed package owns a specific file or command (disabled by default).

   +18 more show less

   • Adds live_response/system/getcap.yaml to collect files with associated process capabilities (Linux).
   • Adds live_response/system/group_name_unknown_files.yaml and user_name_unknown_files.yaml to list files with unknown GID/UID across all major platforms.
   • Adds no_group and no_user artifact properties to search for files whose GID or UID no longer exists on the system.
   • Adds redirect_stderr_to_stdout artifact property to redirect stderr to stdout for complete log capture.
   • Adds JSON output support for findmnt and lsblk storage artifacts (Linux).
   • Adds live_response/system/coredump.yaml and memory_dump/coredump.yaml for core dump, ABRT, Apport, and kdump file collection.
   • Adds live_response/system/journalctl.yaml boot time period listings.
   • Adds live_response/system/sudo_lectured.yaml to collect timestamps of users who saw the sudo lecture message.
   • Adds live_response/system/ulimit.yaml to collect all resource limits information.
   • Adds AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. Agent and Azure Linux VM Agent log/config collection artifacts.
   • Adds numerous recently-accessed-file artifacts for KDE and GNOME applications (Ark, Dolphin, Dragon Player, Geany, Gedit, GNOME Text Editor, Kate/KWrite, KDE MRU, Okular, Konqueror) on BSD and Linux.
   • Adds history file collection for atftp, nano, and PHP on all platforms.
   • Adds NetworkManager connection info via nmcli (Linux).
   • Adds package manager artifacts for 0install, apk, cargo, guix, Conary, KISS, npm, Paludis, Portage, Slackpkg, Soar, and Tazpkg.
   • Adds files/system/upstart.yaml and files/system/xdg_autostart.yaml for persistence collection on Linux.
   • Adds files/system/gvfs_metadata.yaml and live_response/system/kactivitymanagerd.yaml for user activity tracking on BSD/Linux.
   • Updates dpkg.yaml to validate installed packages by comparing files against dpkg database metadata.
   • Updates live_response/process/ps.yaml to capture system date before process snapshot including elapsed time.

   23 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The memory_dump/avml.yaml output file name is renamed from avml.raw to avml.lime; any downstream pipeline expecting avml.raw will break.
5. v3.0.0 Oct 22, 2024 · release notes

   UAC v3.0.0 adds zip/none output formats, cloud transfers, per-file hashing, verbosity control, and dozens of new artifact collectors.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ TRY IT
   Collect a triage image as a password-protected zip with a descriptive filename — useful when transferring evidence to cloud storage with at-rest encryption.
   copy

   $ uac -p ir_triage -o uac-%hostname%-%os%-%timestamp% --output-format zip --output-password 'S3cur3P@ss!' /evidence/case42

   Hash every collected file to produce a chain-of-custody hash manifest alongside the archive.
   copy

   $ uac -p ir_triage -H --output-format zip /evidence/case42

   Run modifier artifacts (e.g., unmounting PID-hijacking filesystems to expose hidden processes) during a live Linux investigation.
   copy

   $ uac -p ir_triage --enable-modifiers --output-format zip /evidence/case42

   • New --enable-modifiers flag lets UAC run artifacts that intentionally change system state (e.g., unmounting filesystems to reveal hidden processes).
   • New none output format copies collected data directly to an output directory without archiving or compression.
   • New zip output format archives and compresses collected data; supports password-protected zip files via --output-password.
   • New -o/--output-base-name option lets analysts set a custom, variable-formatted output filename.
   • Custom profiles, artifact files, and config files can now be supplied by full path, outside their respective default directories, using -c/--config.

   +23 more show less

   • New remote transfer support for Amazon, Google, and IBM cloud storage; falls back to wget when curl is unavailable.
   • New -v/--verbose flag increases verbosity level and displays all executed commands.
   • New -H/--hash-collected flag hashes all collected files and saves results to a hash file.
   • New --validate-profile option validates profile files before collection runs.
   • UAC now uses the built-in astrings function to extract strings from binaries when the strings command is unavailable.
   • Stderr from executed commands is now recorded in uac.log.
   • New global max_depth configuration option in uac.conf limits directory tree search depth globally.
   • New artifact modifier property ensures an artifact only runs when --enable-modifiers is active.
   • New artifact condition property skips collection unless a specified condition evaluates to true.
   • New eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs collection via bpftool on Linux (live_response/system/bpftool.yaml).
   • New collection of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. network details from /proc/net on Linux.
   • New collection of btrfs mountpoints, subvolumes, and snapshots on Linux.
   • New collection of kernel tainted-state messages from dmesg on Linux.
   • New collection of FreeBSD jail information via jls (live_response/containers/jls.yaml).
   • New collection of Solaris extended accounting configuration and last-executed commands.
   • New collection of udev rule files on Linux.
   • New collection of system accounting files for FreeBSD, NetBSD, OpenBSD, and Solaris.
   • New collection of OpenBSD kernel relink log, device-lookup database, locate database, and security backup files.
   • New collection of WhatsApp Desktop files on macOS.
   • New collection of git-related persistence files on Linux and macOS.
   • Statically linked zip binary now bundled for Linux/ESXi (arm, arm64, i386, x86_64) and FreeBSD/NetScaler (i386, x86_64).
   • --artifacts list [OPERATING_SYSTEM] now filters displayed artifacts to a specific OS.
   • AVML updated to v0.14.0.

   28 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !--date-range-start is renamed to --start-date; scripts using the old flag will break.
   • !--date-range-end is renamed to --end-date; scripts using the old flag will break.
   • !--validate-artifacts-file is renamed to --validate-artifact; scripts using the old flag will break.
   • !--s3-presigned-url is renamed to --aws-s3-presigned-url; scripts using the old flag will break.
   • !--s3-presigned-url-log-file is renamed to --aws-s3-presigned-url-log-file; scripts using the old flag will break.
   • !--ibm-cos-url, --ibm-cos-url-log-file, and --ibm-cloud-api-key are removed; IBM cloud transfers must now use --s3-provider, --s3-region, --s3-bucket, and --s3-token.
   • !The output_directory property is now mandatory for command, find, hash, and stat collectors; existing artifact YAML files omitting it will fail.
   • !The file_type artifact property is now an array; artifact YAML files using a scalar value will break.
   • !The permissions artifact property is now an array; artifact YAML files using a scalar value will break.
   • !Android is no longer a supported operating system target; use --operating-system linux to continue collecting from Android devices.
   • !files/logs/additional_logs.yaml is renamed to files/logs/advanced_log_search.yaml; references to the old filename will break.
   • !live_response/system/sys_modules.yaml is removed; use kernel_modules.yaml instead.
6. v2.9.0 May 28, 2024 · release notes

   UAC v2.9.0 adds collection support for multiple package managers (brew, nix, pip, pisi, yay, xbps, equo) and Solaris-specific artifacts

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.9.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v2.9.0

   • uac.log and uac.log.stderr files are moved to the front of the output archive file.
   • Adds collection support for lastlog, wtmpx, utmpx, svc and webui logs outside /var/log in files/logs/solaris.yaml.
   • Adds collection support for package table of contents files in files/packages/pkg_contents.yaml.
   • Adds collection support for svc manifest and method (service start) files in files/system/svc.yaml.
   • Adds collection support for ld config files in files/system/var_ld.yaml.

   +20 more show less

   • Adds collection support for transient and per-user systemd timers artifacts in files/system/systemd.yaml.
   • Adds collection support for NetBSD 10 package contents in files/packages/pkg_contents.yaml.
   • Updates ESXi log collection support in files/logs/var_log.yaml.
   • Adds resource usage statistics collection for Docker containers in live_response/containers/docker.yaml.
   • Adds resource usage statistics collection for Podman containers in live_response/containers/podman.yaml.
   • Adds collection support for Homebrew packages in live_response/packages/brew.yaml.
   • Adds collection support for Entropy package manager in live_response/packages/equo.yaml.
   • Adds collection support for Nix packages in live_response/packages/nix.yaml.
   • Adds collection support for pip-installed Python packages in live_response/packages/pip.yaml.
   • Adds collection support for pisi package manager in live_response/packages/pisi.yaml.
   • Adds collection support for XBPS package manager in live_response/packages/xbps.yaml.
   • Adds collection support for Yay package manager in live_response/packages/yay.yaml.
   • Updates Solaris pkg information collection in live_response/packages/pkg.yaml.
   • Adds memory-mapped files entries to procfs collection in live_response/process/procfs_information.yaml.
   • Adds /proc/modules listing to procfs collection in live_response/process/procfs_information.yaml.
   • Adds Unix sockets listing to procfs collection in live_response/process/procfs_information.yaml.
   • Adds pinned eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. progs listing in live_response/system/ebpf.yaml.
   • Adds kernel module parameters listing in live_response/system/kernel_modules.yaml.
   • Adds loaded kernel modules listing for comparison with /proc/modules in live_response/system/kernel_modules.yaml.
   • Adds kernel module information collection in live_response/system/modinfo.yaml.

   25 details in Everything

7. v2.8.0 Jan 24, 2024 · release notes

   UAC v2.8.0 adds the offline collection profile and new data collection rules for multiple platforms

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.8.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v2.8.0

   └──▷ USE IT
   Perform a collection on an offline disk image using the new profile.
   shell copy

   uac --profile offline /path/to/disk_image

   • Adds the offline profile to profiles/offline.yaml for offline disk image collections
   • Adds --debug flag behavior that preserves the temporary uac-data.tmp directory in the destination
   • Adds support for Box log file collection via files/applications/box.yaml on macOS
   • Adds support for wget HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks. cache file collection via files/applications/wget.yaml on supported platforms
   • Adds support for package table of contents files via files/packages/pkg_contents.yaml on OpenBSD

   +7 more show less

   • Adds support for user GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. shortcut (.desktop) files via files/system/desktop.yaml on FreeBSD, Linux, NetBSD, and OpenBSD
   • Adds exclusion of master password hash files (master.passwd, spwd.db) in files/system/etc.yaml on FreeBSD, NetBSD, NetScaler, and OpenBSD
   • Adds exclusion of group shadow files (gshadow, gshadow-) in files/system/etc.yaml on Linux
   • Adds support for kernel IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. neighbor cache via live_response/network/ndp.yaml on FreeBSD, NetBSD, and OpenBSD
   • Adds support for complete nftables rulesets via live_response/network/nft.yaml on Linux
   • Adds support for running VM information via live_response/vms/vmctl.yaml on OpenBSD
   • Updates collection support for Flatpak versions of Brave, Chrome, Edge, Opera, and Vivaldi browsers on Linux

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The box_drive.yaml file under files/applications/ has been renamed to box.yaml, which may break scripts referencing the old path.
8. v2.7.0 Sep 20, 2023 · release notes

   Adds new collection modules for Find My, rclone, RustDesk, Splashtop, Steam, TeamViewer, ThinLinc, and Netscaler; introduces deprecated nsconfig module

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v2.7.0

   • Adds files/applications/findmy.yaml to collect user's items/devices info from the Find My application on macOS
   • Adds files/applications/rclone.yaml to collect rclone configuration and log files on FreeBSD, Linux, macOS, NetBSD, OpenBSD, Solaris
   • Adds files/applications/rustdesk.yaml to collect RustDesk access logs and screen recordings on Linux, macOS
   • Adds files/applications/splashtop.yaml to collect Splashtop application artifacts on Linux, macOS
   • Adds files/applications/steam.yaml to collect Steam browser artifacts, avatars, config and logs on Linux, macOS

   +6 more show less

   • Adds files/applications/teamviewer.yaml to collect TeamViewer application artifacts on Linux, macOS
   • Adds files/applications/thinlinc.yaml to collect ThinLinc configs, connections and post-session logs on Linux, macOS
   • Adds files/package/installed_applications to collect Info.plist from installed applications on macOS
   • Adds files/system/netscaler.yaml to collect Netscaler system files and directories on Netscaler
   • Adds live_response/storage/mdadm.yaml to collect information on Linux software RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. on Linux
   • Adds live_response/storage/zpool.yaml to collect command history of all ZFS pools on AIX, FreeBSD, Linux, macOS, NetBSD, Netscaler, OpenBSD, Solaris

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !files/system/nsconfig.yaml is deprecated and its artifacts are moved to files/system/netscaler.yaml
9. v2.6.0 May 31, 2023 · release notes

   UAC v2.6.0 adds new artifact collections for Proxmox LXC/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., ZFS ARC, iSCSI, kernel taint state, and memfd-sandboxed files.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.0 https://github.com/tclahr/uac.git
   # already have the repo? check out this version:
   $ git checkout v2.6.0

   └──▷ USE IT
   Collect active/inactive LXC container details including network and storage config using the new pct modules.
   shell copy

   uac -f live_response/containers/pct.yaml

   Gather ZFS ARC cache performance statistics on a FreeBSD or Linux host.
   shell copy

   uac -f live_response/storage/arcstat.yaml

   Retrieve Proxmox VE cluster nodes and their status for a quick health check.
   shell copy

   uac -f live_response/system/pvecm.yaml

   • Adds live_response/containers/lxc.yaml to collect information about all active and inactive Linux containers (LXD), including configuration, network, and storage details
   • Adds specific collection modules in live_response/containers/pct.yaml: current configuration (pct/config), CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. sets list (pct/cpuset) for LXC on Proxmox VE
   • Adds live_response/vms/qm.yaml to collect information about all active and inactive virtual machines running on Proxmox VE, including their configurations
   • Adds live_response/storage/arcstat.yaml to collect ZFS ARC and L2ARC statistics [freebsd, linux, netbsd, openbsd, solaris]
   • Adds live_response/storage/findmnt.yaml to collect all mounted filesystems in a tree-like format [linux]

   +8 more show less

   • Adds live_response/storage/iscsiadm.yaml to collect information about iSCSI connected devices [linux]
   • Adds live_response/storage/ls_dev_disk.yaml to collect mapping of logical volumes with physical disks [linux]
   • Adds live_response/storage/pvesm.yaml to collect status for all Proxmox VE datastores [linux]
   • Adds live_response/system/hidden_directories.yaml, live_response/system/kernel_tainted_state.yaml to collect tainting modules, and live_response/process/deleted.yaml to collect files hidden in memfd sockets [linux]
   • Adds live_response/system/pvecm.yaml to collect Proxmox VE local cluster nodes and status view
   • Adds live_response/system/pvesubscription.yaml to collect Proxmox VM subscription information
   • Adds live_response/system/pveum.yaml to collect Proxmox VE users and groups list
   • Adds live_response/system/pveversion.yaml to collect version information for Proxmox VE packages

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The loop_command property was renamed to foreach; custom artifact files must update this property name to avoid removal in the next release
10. v2.5.0 Feb 22, 2023 · release notes

    Adds memory string extraction for deleted processes via tools/linux_procmemdump.sh and custom stderr output file option in artifacts config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ TRY IT
    Dump memory strings from a deleted process on Linux using the dedicated script
    copy

    $ ./tools/linux_procmemdump.sh <pid>

    Configure UAC to write stderr output to a specific log file for debugging
    yaml copy

    # In your artifacts configuration YAML, add:
    # artifacts:
    #   stderr_output_file: /path/to/custom/stderr.log
    # (See documentation: https://tclahr.github.io/uac-docs/collectors/#stderr_output_file)

    • Adds extraction of process memory sections and strings from /proc/[pid]/mem for deleted processes using the new tools/linux_procmemdump.sh script
    • Adds a new option to define a custom output file name for standard error messages in artifacts configuration

    2 details in Everything

11. v2.4.0 Nov 30, 2022 · release notes

    UAC v2.4.0 adds IBM COS and Azure SAS output targets plus 13 new collection artifacts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ TRY IT
    Push your forensic output archive to IBM Cloud Object Storage for remote retention.
    copy

    $ uac -f windows --ibm-cos-url 'https://s3.us-south.cloud-object-storage.appdomain.cloud/bucket' --ibm-cloud-api-key 'YOUR_API_KEY'

    Send the log file to a pre-signed Azure SAS URL for secure upload.
    copy

    $ uac -f macos --azure-storage-sas-url-log-file 'https://storageaccount.blob.core.windows.net/logs?sv=2021-...&sr=b&sig=...'

    • Adds --ibm-cos-url CLI flag to push the main output file to IBM Cloud Object Storage.
    • Adds --ibm-cos-url-log-file CLI flag to push the log file to IBM Cloud Object Storage.
    • Adds --ibm-cloud-api-key CLI flag for authentication when pushing files to IBM Cloud Object Storage.
    • Adds --azure-storage-sas-url CLI flag to push the main output file to Azure Storage via SAS URLs.
    • Adds --azure-storage-sas-url-log-file CLI flag to push the log file to Azure Storage via SAS URLs.

    +13 more show less

    • New artifact for macOS Biome data files at files/system/biome.yaml.
    • New artifact for macOS saved application state files at files/system/saved_application_state.yaml.
    • New artifact for macOS Unified Logs UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and Timesync files at files/logs/macos_unified_logs.yaml.
    • New artifact for macOS System Integrity Protection (SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic.) status at live_response/system/csrutil.yaml.
    • New artifact for macOS login items via Service Management framework at files/system/startup_items.yaml.
    • New artifact for macOS installed updates history at live_response/packages/softwareupdate.yaml.
    • New artifact for SSH rc files at files/ssh/rc.yaml.
    • New artifact for Google Earth KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. files at files/applications/google_earth.yaml.
    • New artifact for firewall and ufw rule status at live_response/network/ufw.yaml.
    • New artifact for Linux kernel audit status and rules at live_response/system/auditctl.yaml.
    • New artifact for Gentoo Linux installed packages at live_response/packages/qlist.yaml.
    • New artifact for Solaris EEPROM parameter values at live_response/system/eeprom.yaml.
    • New artifact for Solaris installed zones at live_response/system/zoneadm.yaml.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The artifact previously located at files/system/var_db_diagnostics.yaml has been moved and renamed to files/logs/macos_unified_logs.yaml, breaking references to the old path.
12. v2.3.0 Aug 10, 2022 · release notes

    UAC v2.3.0 adds extensive new artifacts for Linux and macOS and allows multiple --artifacts flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ USE IT
    Collect Vivaldi browser artifacts and hidden files in a specific order using multiple --artifacts flags
    shell copy

    uac --artifacts files/browsers/vivaldi.yaml --artifacts live_response/system/hidden_files.yaml -s output.tar

    Collect macOS Powerlog and system keychain using specific artifact paths
    shell copy

    uac --artifacts files/system/powerlog.yaml --artifacts files/system/keychain.yaml -s macos_dump.tar

    Migrate from the deprecated full-with-memory-dump profile to the new multiple artifact syntax
    shell copy

    uac --artifacts memory_dump/avml.yaml -p full -s output.tar

    • Adds support for using multiple --artifacts (-a) flags to collect collections in a specific order
    • Adds collection of /proc/[pid]/fd/* from deleted processes that are not marked as deleted
    • Adds new artifact files/system/dev_shm.yaml to collect contents of /dev/shm
    • Adds new artifact files/system/run_shm.yaml to collect contents of /run/shm
    • Adds new artifact files/system/var_tmp.yaml to collect contents of /var/tmp

    +25 more show less

    • Adds new artifact live_response/system/hidden_files.yaml to list hidden files outside user homes
    • Adds new artifact live_response/system/hidden_directories.yaml to list hidden directories outside user homes
    • Adds new artifact live_response/system/world_writable_files.yaml to list world writable files
    • Adds new artifact live_response/system/world_writable_directories.yaml to list world writable directories
    • Adds new artifact live_response/system/sys_module.yaml to list loaded kernel modules from /sys/module
    • Adds new artifact live_response/system/last.yaml to collect last logins and logouts
    • Adds new artifact live_response/system/lastb.yaml to collect unsuccessful logins
    • Adds new artifact live_response/system/socket_files.yaml to list all socket files
    • Adds new artifact files/system/systemd.yaml (sessions) to collect sessions from /run/systemd/sessions
    • Adds new artifact files/system/systemd.yaml (scope) to collect scope files from /run/systemd/transient
    • Adds new artifact files/browsers/vivaldi.yaml to collect Vivaldi browser artifacts
    • Adds new artifact live_response/system/loginctl.yaml to collect live runtime status and journal log data
    • Adds new artifact files/shell/history.yaml to collect fish shell history files
    • Adds new artifact files/system/tracker.yaml to collect Tracker database files
    • Adds new artifact files/system/ds_store.yaml to collect macOS .DS_Store files
    • Adds new artifact files/system/network_application_usage.yaml to collect macOS network/app usage databases
    • Adds new artifact files/system/powerlog.yaml to collect macOS Powerlog files
    • Adds new artifact files/system/recovery_account_info.yaml to collect macOS recovery account information
    • Adds new artifact files/system/keychain.yaml to collect macOS system keychain file
    • Adds new artifact files/system/system_version.yaml to collect macOS system version file
    • Adds new artifact files/system/var_db_diagnostics.yaml to collect macOS unified logging and activity tracing
    • Adds new artifact live_response/system/tmutil.yaml to collect macOS Time Machine information
    • Adds new artifact files/applications/photos.yaml to collect macOS Photos application database files
    • Adds new artifact live_response/system/who.yaml for AIX failed login attempts from /etc/security/failedlogin
    • Removes /dev from the exclusion list during deleted process collection

    30 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -o command line switch is no longer available and must be replaced by -s
    • !The full-with-memory-dump profile is no longer available; use -a memory_dump/avml.yaml -p full instead
    • !The memory-dump-only profile is no longer available; use -a memory_dump/avml.yaml instead
13. v2.2.0 May 3, 2022 · release notes

    UAC v2.2.0 adds ESXi OS support, S3 presigned URL transfer flags, and new artifact paths for live response collection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    └──▷ HOW TO FIND IT
    Push collected evidence directly to an S3 presigned URL and clean up local files upon success.
    📍uac -s https://s3.amazonaws.com/bucket/object?AWSAccessKeyId=... --s3-presigned-url 'https://s3.amazonaws.com/bucket/output.tar.gz?signature=...' --delete-local-on-successful-transfer
    • Adds --s3-presigned-url switch to push output files to S3 presigned URLs via curl
    • Adds --s3-presigned-url-log-file switch to push the log file to an S3 presigned URL
    • Adds --delete-local-on-successful-transfer switch to delete local output and log files after successful transfer
    • Enables VMware ESXi as a fully supported operating system, expanding coverage beyond Linux/Windows/macOS
    • Adds new artifact paths for ESXi live response: live_response/process/esxcli.yaml, live_response/network/esxcli.yaml, live_response/storage/ls_vmfs_devices.yaml, etc.

    +2 more show less

    • Adds new artifact live_response/process/deleted.yaml to collect binaries and file handles of deleted processes
    • Renames config/artifact path files/applications/icloud_drive.yaml to files/applications/icloud.yaml

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -o command line switch is replaced by -s and will be removed in the next release.
    • !The --sftp-delete-local-on-success command line switch is replaced by --delete-local-on-successful-transfer.
14. v2.1.0 Feb 15, 2022 · release notes

    UAC v2.1.0 adds profiles for Discord and Teams artifacts, a new ir_triage profile, and allows PROFILE with ARTIFACTS flags together

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    └──▷ USE IT
    Collect only incident response triage artifacts using the new profile
    shell copy

    uac --profile ir_triage -o /tmp/triage_output

    Combine a specific profile with additional artifact files for custom collection
    shell copy

    uac -p full -a files/applications/discord.yaml,files/applications/telegram.yaml -o /tmp/custom_collection

    • Adds ir_triage profile to collect incident response triage artifacts only
    • Allows combining -p (PROFILE) and -a (ARTIFACTS) options together for customizable collections
    • Adds Discord artifact collection via files/applications/discord.yaml
    • Adds Facebook Messenger artifact collection via files/applications/facebook_messenger.yaml
    • Adds iMessage artifact collection via files/applications/imessage.yaml

    +32 more show less

    • Adds Microsoft Teams artifact collection via files/applications/microsoft_teams.yaml
    • Adds Signal artifact collection via files/applications/signal.yaml
    • Adds Slack artifact collection via files/applications/slack.yaml
    • Adds Skype artifact collection via files/applications/skype.yaml
    • Adds Telegram Desktop artifact collection via files/applications/telegram.yaml
    • Adds Viber Desktop artifact collection via files/applications/viber.yaml
    • Adds WhatsApp Desktop artifact collection via files/applications/whatsapp.yaml
    • Adds AddressBook database, metadata and image file collection via files/applications/addressbook.yaml
    • Adds Apple Notes app database file collection via files/applications/apple_notes.yaml
    • Adds Aspera Connect file transfer log file collection via files/applications/aspera_connect.yaml
    • Adds Dropbox Cloud Storage Metadata file collection via files/applications/dropbox.yaml
    • Adds FileZilla XML and sqlite file collection via files/applications/filezilla.yaml
    • Adds iCloud database collection for imported/synced files via files/applications/icloud_drive.yaml
    • Adds iTunes Backup directory collection via files/application/itunes_backup.yaml
    • Adds VLC recently opened files collection via files/applications/vlc.yaml
    • Adds Thunderbird artifact collection via files/applications/thunderbird.yaml
    • Adds Apple Accounts database file collection via files/system/apple_accounts.yaml
    • Adds TCC permission prompt information collection via files/system/tcc.yaml
    • Adds Linux Most Recent Used files information collection via files/system/linux_mru.yaml
    • Adds macOS knowledgeC.db file collection via files/system/knowledgec.yaml
    • Adds macOS system and user's preferences/configuration plist file collection via files/system/library_preferences.yaml
    • Adds applications set to reopen after restart/sleep collection via files/system/resumed_applications.yaml
    • Adds temporary files in /tmp directory collection via files/system/tmp.yaml
    • Adds Clear Linux installed bundles information collection via live_response/packages/swupd.yaml
    • Adds zypper tool installed packages information collection via live_response/packages/zypper.yaml
    • Adds macOS installed applications information collection via live_response/packages/pkgutil.yaml
    • Adds GEOM disks statistics collection via live_response/storage/gstat.yaml
    • Adds VirtualBox VMs information collection via live_response/vms/virtualbox.yaml
    • Adds command to compare installed RPM files with metadata in the rpm database
    • Replaces files/browsers/chromium_based.yaml with files/browsers/brave.yaml, files/browsers/chrome.yaml, files/browsers/chromium.yaml, files/browsers/edge.yaml and files/browsers/opera.yaml
    • Updates Firefox browser artifacts to include Flatpak and Snap versions via files/browsers/firefox.yaml
    • Updates Safari artifact to collect Recently Closed Tabs plist file via files/browsers/safari.yaml

    37 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The full-with-memory-dump profile will be removed in a future release; use --profile full --artifacts memory_dump/avml.yaml instead
    • !The memory-dump-only profile will be removed in a future release; use --artifacts memory_dump/avml.yaml instead
15. v2.0.0 Nov 25, 2021 · release notes

    UAC v2.0 adds YAML-based artifact configs, avml volatile memory acquisition, and per-command .stderr files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    └──▷ USE IT
    View error output for a specific collection command without parsing logs
    shell copy

    cat <artifact_name>.stderr

    • Acquires volatile memory from Linux systems using Microsoft's avml tool
    • Command errors will now be stored into individual .stderr files
    • Artifacts collections are now based on YAML files

    3 details in Everything

16. v1.4.0 Feb 23, 2021 · release notes

    Adds -T flag for SCPSCPSecure Copy Protocol, a file-transfer method built on SSH that encrypts data in transit; cyber tools use it to move files to or from remote hosts without exposing credentials or content. transfer and EXCLUDE_MOUNTED_REMOTE_FILE_SYSTEMS config to UAC v1.4.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ USE IT
    Collect UAC data and automatically scp the results to a remote server for analysis.
    shell copy

    uac -T user@remote-server:/path/to/collected_data

    • Adds -T option to automatically transfer the output file to a remote server via scp
    • Honors EXCLUDE_MOUNTED_REMOTE_FILE_SYSTEMS option to exclude afs and rpc_pipefs mounted file systems from collection

    2 details in Everything

17. v1.3.0 Oct 18, 2020 · release notes

    v1.3.0 adds bodyfile collector for ext4 creation time, SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. hashes, and new OS collectors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • The bodyfile collector now collects file creation time on Linux with ext4 file systems
    • SHA-1 is now used in addition to existing hashes for file integrity calculations
    • Adds native support for AIX, BSD, macOS, and Solaris via new dedicated collectors

    3 details in Everything

18. v1.2.0 Jul 26, 2020 · release notes

    UAC v1.2.0 adds process string extraction, new collector flags, OS-specific collectors, and exclusion config support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Adds -k flag to enable the new docker and virtual machines information collector
    • Adds conf/exclude.conf file to specify files and directories to skip during collection
    • Adds AIX, BSD, Linux, macOS and Solaris collectors for broader OS support
    • Enables string extraction from running processes by the process collector

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Mounted remote file systems are now excluded from collection by default
19. v1.1.0 May 27, 2020 · release notes

    v1.1.0 adds collector date-range limiting, validated external binaries, and new OS collectors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/tclahr/uac.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • date_range argument added to limit collected data in logs, misc_files, and user_accounts collectors
    • Support for user-provided validated binary tools during artifact collection
    • Adds collectors for AIX, BSD, Linux, macOS, and Solaris
    • Adds Sleuthkit fls tool extension

    4 details in Everything