https://cybertoolchain.io/tools/uac New releases and features in UAC, tracked by The Cyber Toolchain. en Wed, 09 Sep 2026 11:12:55 GMT https://github.com/tclahr/uac/releases/tag/v3.4.0 https://github.com/tclahr/uac/releases/tag/v3.4.0 Wed, 09 Sep 2026 11:12:55 GMT UAC v3.4.0 adds 20+ AI coding agent artifact collectors (Claude, Copilot, Codex, Gemini, Cursor and more) plus new macOS and AIX artifacts. • Adds `files/applications/ai_tools/amp.yaml` to collect Amp session data, config, and credentials [linux, macos]. • Adds `files/applications/ai_tools/claude_code.yaml` to collect Claude Code session logs, config, credentials, pre-edit file history, tool results, auto-memory, plans, shell snapshots, hook scripts, and IDE lock files [linux, macos]. • Adds `files/applications/ai_tools/claude_desktop.yaml` to collect Claude Desktop transcripts, config, credentials, storage, skill/plugin definitions, and app logs [macos]. • Adds `files/applications/ai_tools/codebuff.yaml` to collect Codebuff chat logs, config, and credentials [linux, macos]. • Adds `files/applications/ai_tools/codex.yaml` to collect OpenAI Codex CLI session logs, config, auth, state/thread-history/log SQLite databases with WAL/SHM sidecars, AGENTS.md, rules, shell snapshots, and installation_id; excludes tmp and cache trees [linux, macos]. • Adds `files/applications/ai_tools/copilot.yaml` to collect GitHub Copilot CLI OTEL usage logs, config, host token/config store, session workspace metadata, plans and checkpoints, session store database with WAL/SHM sidecars and logs, VS Code Copilot Chat conversation transcripts, agent-mode edit snapshots, and extension session store [linux, macos]. • Adds `files/applications/ai_tools/cursor.yaml` to collect Cursor global data, IDE settings, workspace state, history, and logs [linux, macos]. • Adds `files/applications/ai_tools/droid.yaml` to collect Droid session settings, config, and auth [linux, macos]. • Adds `files/applications/ai_tools/gemini.yaml` to collect Gemini CLI chat logs, config, OAuth credentials, custom commands and policies (TOML), GEMINI.md and memory files, and per-project root markers; excludes downloaded binaries, shadow git checkpoints, and the browser profile [linux, macos]. • Adds `files/applications/ai_tools/goose.yaml` to collect Goose session database and config [linux, macos]. • Adds `files/applications/ai_tools/hermes.yaml` to collect Hermes Agent state database and config [linux, macos]. • Adds `files/applications/ai_tools/kilo.yaml` to collect Kilo session database and config [linux, macos]. • Adds `files/applications/ai_tools/kimi.yaml` to collect Kimi session wire logs, config, and credentials [linux, macos]. • Adds `files/applications/ai_tools/kiro.yaml` to collect Kiro global config, MCP, agents, steering, prompts, skills, sessions, and CLI/IDE data [linux, macos]. • Adds `files/applications/ai_tools/openclaw.yaml` to collect OpenClaw session logs, config, and auth [linux, macos]. • Adds `files/applications/ai_tools/opencode.yaml` to collect OpenCode session data, config, credentials, SQLite WAL/SHM sidecars, logs, JSONC config, agent and command definitions, and the state directory; excludes node_modules, cloned repos, and snapshots [linux, macos]. • Adds `files/applications/ai_tools/pi_agent.yaml` to collect pi-agent session logs, config, and credentials [linux, macos]. • Adds `files/applications/ai_tools/qwen.yaml` to collect Qwen Code chat logs, config, and OAuth credentials [linux, macos]. • Adds `files/system/macos_privilegedhelpertools.yaml` to collect macOS PrivilegedHelperTools, which may be used for persistence [macos]. • Adds `files/system/trash.yaml` to collect the entire Trash directory contents [freebsd, linux, macos, netbsd, openbsd]. • Adds `live_response/network/rmsock.yaml` to identify process ownership for TCP network connections, associating PIDs with network activity on AIX systems where lsof is unavailable [aix]. • Extends `live_response/containers/docker.yaml` artifact collection to macOS [macos]. • Extends `live_response/network/netstat.yaml` to include `netstat -Aan` [aix]. • Extends `live_response/process/fstat.yaml` to include `fstat -n` [freebsd, netbsd, netscaler, openbsd]. • Extends `live_response/process/ps.yaml` to include richer `ps -eo` output formats with `lstart`, `etime`, and `pcpu`/`pmem` columns across Linux, macOS, FreeBSD, NetBSD, NetScaler, OpenBSD, AIX, and Solaris. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v3.3.0 https://github.com/tclahr/uac/releases/tag/v3.3.0 Thu, 16 Apr 2026 21:17:25 GMT UAC v3.3.0 adds user-defined variables, per-file command execution, size-based mount exclusions, and a wave of new artifacts. • New `--define` / `-D` flag lets you pass user-defined variables on the command line, expanded inside artifacts as `%var%` or `%var=default_value%`. • New `--system-info` flag prints CPU, memory, hostname, and other system details without running a full collection. • The `find` collector can now run a specified `command` once for each matched file. • New `exclude_mount_point_size` option in `uac.conf` skips mount points whose used size exceeds a defined threshold. • Artifact fields `max_file_size` and `min_file_size` now accept human-readable units: bytes, KB, MB, GB, and TB. • New `statf` built-in tool produces bodyfile-format file status output on FreeBSD systems that lack `stat` and `perl`. • New `system/bodyfile2filelists.yaml` artifact extracts SUID, SGID, hidden, world-writable, group-writable, and unknown-owner file/directory lists from a previously collected bodyfile. • New per-shell artifact files added for ash, bash, dash, elvish, fish, ion, ksh, mksh, nscli (NetScaler), osh, PowerShell, tcsh, xonsh, and zsh history and config collection. • New `files/ssh/public_keys.yaml` collects SSH public keys across all platforms. • New `ssh/private_keys_with_null_passphrases.yaml` collects SSH public keys whose associated private keys have empty passphrases. • New Linux artifacts for boot/initramfs/GRUB configs, D-Bus configs, dracut configs, polkit configs, and binfmt_misc handlers — all flagged as possible persistence mechanisms. • New macOS artifact `files/system/bluetooth.yaml` collects cached records of observed Bluetooth devices. • New macOS artifact `files/system/macos_keychain_devicelist.yaml` collects trusted device records from iCloud Keychain's `devicelist.db`. • New macOS artifact `files/system/xprotect.yaml` collects XProtect and MRT versioning metadata. • New application artifacts for calc, mail (.mailrc/.mail_aliases), nano, Python, screen, sqlite history/config, and Jenkins `config.xml`/`build.xml` files. • Browser affiliation database files now collected for Brave, Chrome, Chromium, Edge, Opera, Safari, and Vivaldi on Linux and macOS. • Azure Storage upload now automatically appends output and log file names to the SAS URL, eliminating the need for a separate log-file URL. • `live_response/network/ss.yaml` updated to capture PACKET sockets, classic BPF filters, and process name/PID per socket on Linux. • `memory_dump/avml.yaml` updated to also collect `vmlinux*` and `System.map*` files to aid Volatility profile building, and exposes an `avml_max_memory` variable to override the 256 GB memory cap. Breaking changes: • The `--azure-storage-sas-url-log-file` option has been removed; the log file name is now appended automatically to the URL given in `--azure-storage-sas-url`. • `files/applications/imessage.yaml` is renamed to `files/applications/messages.yaml`; any profile or script referencing the old name will no longer match. • `files/shell/config.yaml`, `files/shell/history.yaml`, and `files/shell/sessions.yaml` are replaced by per-shell YAML files (e.g., `files/shell/bash.yaml`, `files/shell/zsh.yaml`); custom profiles referencing the old artifact paths will no longer match. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v3.2.0 https://github.com/tclahr/uac/releases/tag/v3.2.0 Wed, 13 Aug 2025 11:10:51 GMT UAC v3.2.0 adds AWS Sig v4 S3 transfers, OS-specific config overrides, symlink collection by default, and new forensic artifacts. • Supports AWS Signature Version 4 (AWS4-HMAC-SHA256) for Amazon S3 output file transfers. • Adds runtime variable support for `--aws-s3-presigned-url`, `--aws-s3-presigned-url-log-file`, `--azure-storage-sas-url`, and `--azure-storage-sas-url-log-file`. • Enables OS-specific configuration overrides by placing files named after the OS in the `config` directory. • Bundles `timeout.sh` in the `bin` directory, providing a portable `timeout` command equivalent across all supported operating systems. • Now collects both regular files and symbolic links by default when `file_type` is not specified in an artifact. • Adds new `files/applications/google_drive.yaml` artifact for Google Drive metadata databases and log files [macOS]. • Adds new `files/browsers/cache.yaml` artifact for browser cache data [FreeBSD, Linux, macOS] (disabled by default in all profiles). • Adds new `files/system/vyatta.yaml` artifact for Vyatta and VyOS configuration files [Linux]. • Adds `live_response/modifiers/disable_ftrace.yaml` modifier to disable ftrace and prevent syscall hooking by LKM rootkits [Linux]. • Adds `live_response/system/loginctl.yaml` artifact for terse runtime status of each user via `loginctl` [Linux]. • Adds `live_response/system/utmpdump.yaml` artifact for utmp and wtmp (including log-rotated) files via `utmpdump` [Linux]. • Adds `live_response/system/show.yaml` artifact for consolidated tech-support reports from Vyatta and VyOS systems [Linux]. • Extends `/proc/modules` collection in `live_response/process/procfs_information.yaml` [AIX, FreeBSD, Linux, NetBSD, NetScaler, Solaris]. • Adds new osquery queries for `apt_sources`, `deb_packages`, `shell_history`, `system_controls`, `logged_in_users`, and `last_logins` [Linux]. • Extends `files/system/user_accounts.yaml` to collect macOS login history recovered from `.plist` files. • Updates `--validate-artifact` to verify that `f` is included in `file_type` when `max_file_type` or `min_file_type` is specified. • Extends `mdatp` artifact support to include macOS. • Renames `--sftp-ssh-options` to `--sftp-ssh-option`, now accepting key=value pairs and usable multiple times for multiple SSH options. Breaking changes: • The `--sftp-ssh-options` flag is renamed to `--sftp-ssh-option`; any script or config using `--sftp-ssh-options` will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v3.1.0 https://github.com/tclahr/uac/releases/tag/v3.1.0 Thu, 20 Mar 2025 11:29:51 GMT UAC v3.1.0 adds rootkit detection via debugfs/xfs_db, an offline IR triage profile, OSQuery integration, and dozens of new Linux/BSD artifacts. • Adds collection of hidden `/etc/ld.so.preload` using `debugfs` and `xfs_db` to surface stealthy Linux rootkit indicators. • Introduces `offline_ir_triage` profile for offline triage collections. • Adds OSQuery artifact collection via `osqueryi` binary placed in the `bin` directory (Linux). • Adds artifact to list immutable files on Linux systems (`live_response/system/immutable_files.yaml`). • Adds `live_response/packages/package_owns_file.yaml` to determine which installed package owns a specific file or command (disabled by default). • Adds `live_response/system/getcap.yaml` to collect files with associated process capabilities (Linux). • Adds `live_response/system/group_name_unknown_files.yaml` and `user_name_unknown_files.yaml` to list files with unknown GID/UID across all major platforms. • Adds `no_group` and `no_user` artifact properties to search for files whose GID or UID no longer exists on the system. • Adds `redirect_stderr_to_stdout` artifact property to redirect stderr to stdout for complete log capture. • Adds JSON output support for `findmnt` and `lsblk` storage artifacts (Linux). • Adds `live_response/system/coredump.yaml` and `memory_dump/coredump.yaml` for core dump, ABRT, Apport, and kdump file collection. • Adds `live_response/system/journalctl.yaml` boot time period listings. • Adds `live_response/system/sudo_lectured.yaml` to collect timestamps of users who saw the sudo lecture message. • Adds `live_response/system/ulimit.yaml` to collect all resource limits information. • Adds AWS SSM Agent and Azure Linux VM Agent log/config collection artifacts. • Adds numerous recently-accessed-file artifacts for KDE and GNOME applications (Ark, Dolphin, Dragon Player, Geany, Gedit, GNOME Text Editor, Kate/KWrite, KDE MRU, Okular, Konqueror) on BSD and Linux. • Adds history file collection for atftp, nano, and PHP on all platforms. • Adds NetworkManager connection info via `nmcli` (Linux). • Adds package manager artifacts for 0install, apk, cargo, guix, Conary, KISS, npm, Paludis, Portage, Slackpkg, Soar, and Tazpkg. • Adds `files/system/upstart.yaml` and `files/system/xdg_autostart.yaml` for persistence collection on Linux. • Adds `files/system/gvfs_metadata.yaml` and `live_response/system/kactivitymanagerd.yaml` for user activity tracking on BSD/Linux. • Updates `dpkg.yaml` to validate installed packages by comparing files against dpkg database metadata. • Updates `live_response/process/ps.yaml` to capture system date before process snapshot including elapsed time. Breaking changes: • The `memory_dump/avml.yaml` output file name is renamed from `avml.raw` to `avml.lime`; any downstream pipeline expecting `avml.raw` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v3.0.0 https://github.com/tclahr/uac/releases/tag/v3.0.0 Tue, 22 Oct 2024 12:51:11 GMT UAC v3.0.0 adds zip/none output formats, cloud transfers, per-file hashing, verbosity control, and dozens of new artifact collectors. • New `--enable-modifiers` flag lets UAC run artifacts that intentionally change system state (e.g., unmounting filesystems to reveal hidden processes). • New `none` output format copies collected data directly to an output directory without archiving or compression. • New `zip` output format archives and compresses collected data; supports password-protected zip files via `--output-password`. • New `-o/--output-base-name` option lets analysts set a custom, variable-formatted output filename. • Custom profiles, artifact files, and config files can now be supplied by full path, outside their respective default directories, using `-c/--config`. • New remote transfer support for Amazon, Google, and IBM cloud storage; falls back to `wget` when `curl` is unavailable. • New `-v/--verbose` flag increases verbosity level and displays all executed commands. • New `-H/--hash-collected` flag hashes all collected files and saves results to a hash file. • New `--validate-profile` option validates profile files before collection runs. • UAC now uses the built-in `astrings` function to extract strings from binaries when the `strings` command is unavailable. • Stderr from executed commands is now recorded in `uac.log`. • New global `max_depth` configuration option in `uac.conf` limits directory tree search depth globally. • New artifact `modifier` property ensures an artifact only runs when `--enable-modifiers` is active. • New artifact `condition` property skips collection unless a specified condition evaluates to true. • New eBPF programs collection via `bpftool` on Linux (`live_response/system/bpftool.yaml`). • New collection of TCP/UDP network details from `/proc/net` on Linux. • New collection of btrfs mountpoints, subvolumes, and snapshots on Linux. • New collection of kernel tainted-state messages from `dmesg` on Linux. • New collection of FreeBSD jail information via `jls` (`live_response/containers/jls.yaml`). • New collection of Solaris extended accounting configuration and last-executed commands. • New collection of udev rule files on Linux. • New collection of system accounting files for FreeBSD, NetBSD, OpenBSD, and Solaris. • New collection of OpenBSD kernel relink log, device-lookup database, locate database, and security backup files. • New collection of WhatsApp Desktop files on macOS. • New collection of git-related persistence files on Linux and macOS. • Statically linked `zip` binary now bundled for Linux/ESXi (arm, arm64, i386, x86_64) and FreeBSD/NetScaler (i386, x86_64). • `--artifacts list [OPERATING_SYSTEM]` now filters displayed artifacts to a specific OS. • AVML updated to v0.14.0. Breaking changes: • `--date-range-start` is renamed to `--start-date`; scripts using the old flag will break. • `--date-range-end` is renamed to `--end-date`; scripts using the old flag will break. • `--validate-artifacts-file` is renamed to `--validate-artifact`; scripts using the old flag will break. • `--s3-presigned-url` is renamed to `--aws-s3-presigned-url`; scripts using the old flag will break. • `--s3-presigned-url-log-file` is renamed to `--aws-s3-presigned-url-log-file`; scripts using the old flag will break. • `--ibm-cos-url`, `--ibm-cos-url-log-file`, and `--ibm-cloud-api-key` are removed; IBM cloud transfers must now use `--s3-provider`, `--s3-region`, `--s3-bucket`, and `--s3-token`. • The `output_directory` property is now mandatory for `command`, `find`, `hash`, and `stat` collectors; existing artifact YAML files omitting it will fail. • The `file_type` artifact property is now an array; artifact YAML files using a scalar value will break. • The `permissions` artifact property is now an array; artifact YAML files using a scalar value will break. • Android is no longer a supported operating system target; use `--operating-system linux` to continue collecting from Android devices. • `files/logs/additional_logs.yaml` is renamed to `files/logs/advanced_log_search.yaml`; references to the old filename will break. • `live_response/system/sys_modules.yaml` is removed; use `kernel_modules.yaml` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.9.0 https://github.com/tclahr/uac/releases/tag/v2.9.0 Tue, 28 May 2024 11:49:29 GMT UAC v2.9.0 adds collection support for multiple package managers (brew, nix, pip, pisi, yay, xbps, equo) and Solaris-specific artifacts • `uac.log` and `uac.log.stderr` files are moved to the front of the output archive file. • Adds collection support for lastlog, wtmpx, utmpx, svc and webui logs outside `/var/log` in `files/logs/solaris.yaml`. • Adds collection support for package table of contents files in `files/packages/pkg_contents.yaml`. • Adds collection support for svc manifest and method (service start) files in `files/system/svc.yaml`. • Adds collection support for ld config files in `files/system/var_ld.yaml`. • Adds collection support for transient and per-user systemd timers artifacts in `files/system/systemd.yaml`. • Adds collection support for NetBSD 10 package contents in `files/packages/pkg_contents.yaml`. • Updates ESXi log collection support in `files/logs/var_log.yaml`. • Adds resource usage statistics collection for Docker containers in `live_response/containers/docker.yaml`. • Adds resource usage statistics collection for Podman containers in `live_response/containers/podman.yaml`. • Adds collection support for Homebrew packages in `live_response/packages/brew.yaml`. • Adds collection support for Entropy package manager in `live_response/packages/equo.yaml`. • Adds collection support for Nix packages in `live_response/packages/nix.yaml`. • Adds collection support for pip-installed Python packages in `live_response/packages/pip.yaml`. • Adds collection support for pisi package manager in `live_response/packages/pisi.yaml`. • Adds collection support for XBPS package manager in `live_response/packages/xbps.yaml`. • Adds collection support for Yay package manager in `live_response/packages/yay.yaml`. • Updates Solaris pkg information collection in `live_response/packages/pkg.yaml`. • Adds memory-mapped files entries to procfs collection in `live_response/process/procfs_information.yaml`. • Adds `/proc/modules` listing to procfs collection in `live_response/process/procfs_information.yaml`. • Adds Unix sockets listing to procfs collection in `live_response/process/procfs_information.yaml`. • Adds pinned eBPF progs listing in `live_response/system/ebpf.yaml`. • Adds kernel module parameters listing in `live_response/system/kernel_modules.yaml`. • Adds loaded kernel modules listing for comparison with `/proc/modules` in `live_response/system/kernel_modules.yaml`. • Adds kernel module information collection in `live_response/system/modinfo.yaml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.8.0 https://github.com/tclahr/uac/releases/tag/v2.8.0 Wed, 24 Jan 2024 11:34:44 GMT UAC v2.8.0 adds the 'offline' collection profile and new data collection rules for multiple platforms • Adds the `offline` profile to `profiles/offline.yaml` for offline disk image collections • Adds `--debug` flag behavior that preserves the temporary `uac-data.tmp` directory in the destination • Adds support for Box log file collection via `files/applications/box.yaml` on macOS • Adds support for wget HSTS cache file collection via `files/applications/wget.yaml` on supported platforms • Adds support for package table of contents files via `files/packages/pkg_contents.yaml` on OpenBSD • Adds support for user GUI shortcut (.desktop) files via `files/system/desktop.yaml` on FreeBSD, Linux, NetBSD, and OpenBSD • Adds exclusion of master password hash files (`master.passwd`, `spwd.db`) in `files/system/etc.yaml` on FreeBSD, NetBSD, NetScaler, and OpenBSD • Adds exclusion of group shadow files (`gshadow`, `gshadow-`) in `files/system/etc.yaml` on Linux • Adds support for kernel IPv6 neighbor cache via `live_response/network/ndp.yaml` on FreeBSD, NetBSD, and OpenBSD • Adds support for complete nftables rulesets via `live_response/network/nft.yaml` on Linux • Adds support for running VM information via `live_response/vms/vmctl.yaml` on OpenBSD • Updates collection support for Flatpak versions of Brave, Chrome, Edge, Opera, and Vivaldi browsers on Linux Breaking changes: • The `box_drive.yaml` file under `files/applications/` has been renamed to `box.yaml`, which may break scripts referencing the old path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.7.0 https://github.com/tclahr/uac/releases/tag/v2.7.0 Wed, 20 Sep 2023 11:43:14 GMT Adds new collection modules for Find My, rclone, RustDesk, Splashtop, Steam, TeamViewer, ThinLinc, and Netscaler; introduces deprecated nsconfig module • Adds `files/applications/findmy.yaml` to collect user's items/devices info from the Find My application on macOS • Adds `files/applications/rclone.yaml` to collect rclone configuration and log files on FreeBSD, Linux, macOS, NetBSD, OpenBSD, Solaris • Adds `files/applications/rustdesk.yaml` to collect RustDesk access logs and screen recordings on Linux, macOS • Adds `files/applications/splashtop.yaml` to collect Splashtop application artifacts on Linux, macOS • Adds `files/applications/steam.yaml` to collect Steam browser artifacts, avatars, config and logs on Linux, macOS • Adds `files/applications/teamviewer.yaml` to collect TeamViewer application artifacts on Linux, macOS • Adds `files/applications/thinlinc.yaml` to collect ThinLinc configs, connections and post-session logs on Linux, macOS • Adds `files/package/installed_applications` to collect Info.plist from installed applications on macOS • Adds `files/system/netscaler.yaml` to collect Netscaler system files and directories on Netscaler • Adds `live_response/storage/mdadm.yaml` to collect information on Linux software RAID on Linux • Adds `live_response/storage/zpool.yaml` to collect command history of all ZFS pools on AIX, FreeBSD, Linux, macOS, NetBSD, Netscaler, OpenBSD, Solaris Breaking changes: • `files/system/nsconfig.yaml` is deprecated and its artifacts are moved to `files/system/netscaler.yaml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.6.0 https://github.com/tclahr/uac/releases/tag/v2.6.0 Wed, 31 May 2023 10:53:47 GMT UAC v2.6.0 adds new artifact collections for Proxmox LXC/QEMU, ZFS ARC, iSCSI, kernel taint state, and memfd-sandboxed files. • Adds `live_response/containers/lxc.yaml` to collect information about all active and inactive Linux containers (LXD), including configuration, network, and storage details • Adds specific collection modules in `live_response/containers/pct.yaml`: current configuration (`pct/config`), CPU sets list (`pct/cpuset`) for LXC on Proxmox VE • Adds `live_response/vms/qm.yaml` to collect information about all active and inactive virtual machines running on Proxmox VE, including their configurations • Adds `live_response/storage/arcstat.yaml` to collect ZFS ARC and L2ARC statistics [freebsd, linux, netbsd, openbsd, solaris] • Adds `live_response/storage/findmnt.yaml` to collect all mounted filesystems in a tree-like format [linux] • Adds `live_response/storage/iscsiadm.yaml` to collect information about iSCSI connected devices [linux] • Adds `live_response/storage/ls_dev_disk.yaml` to collect mapping of logical volumes with physical disks [linux] • Adds `live_response/storage/pvesm.yaml` to collect status for all Proxmox VE datastores [linux] • Adds `live_response/system/hidden_directories.yaml`, `live_response/system/kernel_tainted_state.yaml` to collect tainting modules, and `live_response/process/deleted.yaml` to collect files hidden in memfd sockets [linux] • Adds `live_response/system/pvecm.yaml` to collect Proxmox VE local cluster nodes and status view • Adds `live_response/system/pvesubscription.yaml` to collect Proxmox VM subscription information • Adds `live_response/system/pveum.yaml` to collect Proxmox VE users and groups list • Adds `live_response/system/pveversion.yaml` to collect version information for Proxmox VE packages Breaking changes: • The `loop_command` property was renamed to `foreach`; custom artifact files must update this property name to avoid removal in the next release Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.5.0 https://github.com/tclahr/uac/releases/tag/v2.5.0 Wed, 22 Feb 2023 10:46:07 GMT Adds memory string extraction for deleted processes via 'tools/linux_procmemdump.sh' and custom stderr output file option in artifacts config • Adds extraction of process memory sections and strings from '/proc/[pid]/mem' for deleted processes using the new `tools/linux_procmemdump.sh` script • Adds a new option to define a custom output file name for standard error messages in artifacts configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.4.0 https://github.com/tclahr/uac/releases/tag/v2.4.0 Wed, 30 Nov 2022 10:01:43 GMT UAC v2.4.0 adds IBM COS and Azure SAS output targets plus 13 new collection artifacts • Adds `--ibm-cos-url` CLI flag to push the main output file to IBM Cloud Object Storage. • Adds `--ibm-cos-url-log-file` CLI flag to push the log file to IBM Cloud Object Storage. • Adds `--ibm-cloud-api-key` CLI flag for authentication when pushing files to IBM Cloud Object Storage. • Adds `--azure-storage-sas-url` CLI flag to push the main output file to Azure Storage via SAS URLs. • Adds `--azure-storage-sas-url-log-file` CLI flag to push the log file to Azure Storage via SAS URLs. • New artifact for macOS Biome data files at `files/system/biome.yaml`. • New artifact for macOS saved application state files at `files/system/saved_application_state.yaml`. • New artifact for macOS Unified Logs UUID and Timesync files at `files/logs/macos_unified_logs.yaml`. • New artifact for macOS System Integrity Protection (SIP) status at `live_response/system/csrutil.yaml`. • New artifact for macOS login items via Service Management framework at `files/system/startup_items.yaml`. • New artifact for macOS installed updates history at `live_response/packages/softwareupdate.yaml`. • New artifact for SSH rc files at `files/ssh/rc.yaml`. • New artifact for Google Earth KML files at `files/applications/google_earth.yaml`. • New artifact for firewall and ufw rule status at `live_response/network/ufw.yaml`. • New artifact for Linux kernel audit status and rules at `live_response/system/auditctl.yaml`. • New artifact for Gentoo Linux installed packages at `live_response/packages/qlist.yaml`. • New artifact for Solaris EEPROM parameter values at `live_response/system/eeprom.yaml`. • New artifact for Solaris installed zones at `live_response/system/zoneadm.yaml`. Breaking changes: • The artifact previously located at 'files/system/var_db_diagnostics.yaml' has been moved and renamed to 'files/logs/macos_unified_logs.yaml', breaking references to the old path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.2.0 https://github.com/tclahr/uac/releases/tag/v2.2.0 Tue, 03 May 2022 09:56:17 GMT UAC v2.2.0 adds ESXi OS support, S3 presigned URL transfer flags, and new artifact paths for live response collection. • Adds `--s3-presigned-url` switch to push output files to S3 presigned URLs via curl • Adds `--s3-presigned-url-log-file` switch to push the log file to an S3 presigned URL • Adds `--delete-local-on-successful-transfer` switch to delete local output and log files after successful transfer • Enables VMware ESXi as a fully supported operating system, expanding coverage beyond Linux/Windows/macOS • Adds new artifact paths for ESXi live response: `live_response/process/esxcli.yaml`, `live_response/network/esxcli.yaml`, `live_response/storage/ls_vmfs_devices.yaml`, etc. • Adds new artifact `live_response/process/deleted.yaml` to collect binaries and file handles of deleted processes • Renames config/artifact path `files/applications/icloud_drive.yaml` to `files/applications/icloud.yaml` Breaking changes: • The `-o` command line switch is replaced by `-s` and will be removed in the next release. • The `--sftp-delete-local-on-success` command line switch is replaced by `--delete-local-on-successful-transfer`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac https://github.com/tclahr/uac/releases/tag/v2.0.0 https://github.com/tclahr/uac/releases/tag/v2.0.0 Thu, 25 Nov 2021 11:34:05 GMT UAC v2.0 adds YAML-based artifact configs, avml volatile memory acquisition, and per-command .stderr files. • Acquires volatile memory from Linux systems using Microsoft's `avml` tool • Command errors will now be stored into individual `.stderr` files • Artifacts collections are now based on YAML files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/uac