UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.
Documentation • Main Features • Supported Operating Systems • Using UAC • Contributing • Support • License
Project documentation page: https://tclahr.github.io/uac-docs
- Run everywhere with no dependencies (no installation required).
- Customizable and extensible collections and artifacts.
- Respect the order of volatility during artifact collection.
- Collect information from processes running without a binary on disk.
- Hash running processes and executable files.
- Extract information from files and directories to create a bodyfile (including enhanced file attributes for ext4).
- Collect user and system configuration files and logs.
- Collect artifacts from applications.
- Acquire volatile memory from Linux systems using different methods and tools.
UAC runs on any Unix-like system (regardless of the processor architecture). All UAC needs is shell :)
Note that UAC even runs on systems like Network Attached Storage (NAS) devices, Network devices such as OpenWrt, and IoT devices.
UAC does not need to be installed on the target system. You only need to download the latest version from the releases page, uncompress and run it. As simple as that!
A profile name and/or a list of artifacts, and the destination directory need to be provided to run a collection. The remaining parameters are optional.
Full Disk Access permission is a privacy feature introduced in macOS Mojave (10.14) that prevents some applications from accessing important data, such as Mail, Messages, and Safari files. So it is strongly recommended that you manually grant permission for Terminal application before running UAC from the terminal, or grant permission for remote users before running UAC via ssh.
Common usage scenarios may include the following:
Collect all artifacts based on the full profile, and create the output file in /tmp.
./uac -p full /tmpCollect all live_response, and the bodyfile/bodyfile.yaml artifact, and create the output file in the current directory.
./uac -a live_response/\*,bodyfile/bodyfile.yaml .Collect all artifacts based on the full profile, but exclude the bodyfile/bodyfile.yaml artifact, and create the output file in /tmp.
./uac -p full -a \!bodyfile/bodyfile.yaml /tmpCollect the memory dump, then all artifacts based on the full profile.
./uac -a artifacts/memory_dump/avml.yaml -p full /tmpCollect the memory dump, then all artifacts based on the ir_triage profile excluding the bodyfile/bodyfile.yaml artifact.
./uac -a ./artifacts/memory_dump/avml.yaml -p ir_triage -a \!artifacts/bodyfile/bodyfile.yaml /tmpCollect all artifacts based on the full profile, but limit the data collection based on the date range provided.
./uac -p full /tmp --date-range-start 2021-05-01 --date-range-end 2021-08-31Collect all but live response artifacts from a Linux disk image mounted in /mnt/ewf.
./uac -p full -a \!live_response/\* /tmp --mount-point /mnt/ewf --operating-system linuxPlease check the project documentation page for more information about command line options, how to create your own artifacts, profiles, and more!
Have you created any artifact files? Please share them with us!
You can contribute with new artifacts, profiles, bug fixes or even propose new features. Please read our Contributing Guide before submitting a Pull Request to the project.
For general help using UAC, please refer to the project documentation page. For additional help, you can use one of the channels to ask a question:
- Discord (For live discussion with the community and UAC team)
- GitHub (Bug reports and contributions)
- Twitter (Get the news fast)
The UAC project uses the Apache License Version 2.0 software license.