Thiago Lahr

[Vivek | Cybersecurity @VivekIntel]

🚨 Streamline Unix Incident Response & Forensics with UAC

UAC (Unix-like Artifacts Collector) is a powerful DFIR toolkit built for forensic investigators, incident responders & security analysts. 🛡️

⚡ Collect artifacts from:
🐧 Linux
🍎 macOS
🖥️ ESXi
🧱 BSD systems
☀️ Solaris & more

✅ Portable & dependency-free
✅ YAML-based customization
✅ Memory acquisition support
✅ Volatility-aware artifact collection

🔗 https://t.co/IpaLUKefTl

#DFIR #IncidentResponse #CyberSecurity #DigitalForensics #LinuxSecurity #ThreatHunting

[Centri @centri_org]

Tool Spotlight: Unix-like Artifacts Collector

An incident response tool that captures forensic evidence from Linux, macOS, and other Unix-like systems without taking them offline. Instead of manually pulling logs and config files one by one, it automatically collects system files and current state into a single package so you can preserve key evidence and start your investigation faster.

Here's how it helps during investigations:

- No installation needed. Just drop it on the host and run it.
- Collects key artifacts such as command history, processes, and network connections
- Lets you customize what to collect so you only grab what you need

Can optionally capture Linux memory dumps for deeper triage.

#cybersecurityawareness #Cybertools #incidentresponse #Linux #cybersecuritytools #digitalforensics #securitytools #cyberinvestigation

[Kostas @Kostastsale]

I recently had to use UAC, the Unix-like Artifacts Collector, for the first time.

I had seen it before, but I mostly relied on custom tooling for Unix-like artifact collection. After using it properly, I honestly don’t know why I waited this long.

It’s a really solid tool for live response and triage. It can collect useful artifacts like system logs, process and network state, user activity, persistence locations, shell history, SSH artifacts, and suspicious file permissions.

If you are collecting forensic data from Unix-like systems and don’t want to take a full disk image, UAC is absolutely worth checking out.

https://t.co/Tcw3oT3oVb

[SandsBytes @SandsBytes]

🌟 We are thrilled to announce that SandsBytes now supports 70+ artifacts from UAC (Unix-like Artifacts Collector)!

DFIR investigators can now analyze multiple Unix-like machines from a single interface to spot malicious activity at scale.
#DFIR #ThreatHunting #UAC

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v3.0.0 released!

🌟 New features
🔎 New artifacts
👨‍💻 Thanks to all the contributors!!!

Get it here: https://t.co/Bexp7cc6Zt #digitalforensics #cybersecurity #infosec

[Thiago Lahr @tclahr]

#UAC (Unix-like Artifacts Collector) v2.9.0 released!

🔎 New artifacts
👨‍💻 Special thanks to all the contributors!

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #cybersecurity #infosec

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.8.0 released!

🌟 New features
🔎 New artifacts
🐛 Bug fixes
👨‍💻 Thanks to all the contributors!!!

Get it here: https://t.co/8lPPHaDPkv
#dfir #digitalforensics #cybersecurity #infosec

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.7.0 released!

🔎New artifacts
👨‍💻Thanks to all the contributors!!!

Get it here: https://t.co/8lPPHaDPkv
#dfir #digitalforensics #cybersecurity #infosec

[Help Net Security @helpnetsecurity]

UAC: Live response collection script for incident response - https://t.co/mdwuuL0CZo - @tclahr @Linkavych @GitHub #OpenSource #IncidentResponse #Unix #CyberSecurity #netsec #security #InfoSecurity #CyberSecurityNews #SecurityNews #GitHub

[Thiago Lahr @tclahr]

@Securityblog It collects running processes info, hashes running processes and executable files, lists network connections, collects logs, shell history files, it extracts information from files and directories to create a bodyfile (very useful for timeline creation)...

[Thiago Lahr @tclahr]

[CVE-2023-3519] Did you know you can use #UAC to triage #NetScaler #CitrixGateway #CitrixADC devices?

Get it here: https://t.co/8lPPHaDPkv

#DFIR #infosec #cybersecurity #zeroday #RCE #Citrix

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.6.0 released!

🔍 New artifacts
👨‍💻 Thanks to all the contributors!!!

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #incidentresponse #cybersecurity

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.6.0-rc1 released!

🔍 New artifacts
👨‍💻 Thanks to all the contributors!!!

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #incidentresponse #cybersecurity

[Carlos Cajigas @Carlos_Cajigas]

Today I got an opportunity to hang out with @tclahr, the creator of UAC. He has recently released a @velocidex artifact so that UAC can be used to collect *NIX triage images at scale. Have you lveraged Velo for collections, you want to follow him Thanks for your time/work on UAC!

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.5.0 released!

🌟 New features
🔍 New artifacts

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #incidentresponse #cybersecurity

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.5.0-rc1 released!

🌟 New features
🔍 New artifacts

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #incidentresponse #cybersecurity

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.4.1 released!

🐛 Bug fixes

Get it here: https://t.co/8lPPHaDPkv

#dfir #digitalforensics #incidentresponse #cybersecurity #foss

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.4.0 released!

🌟 New features
🔍 New artifacts

Get it here: https://t.co/8lPPHaDPkv
#dfir #digitalforensics #incidentresponse #cybersecurity #foss

[Thiago Lahr @tclahr]

New #UAC (Unix-like Artifacts Collector) v2.4.0-rc1 released!

🌟 New features
🔍 New artifacts

Get it here: https://t.co/8lPPHaEna3
#dfir #digitalforensics #incidentresponse #cybersecurity #FOSS

[WhatDoesKmean? @WhatDoesKmean]

Did you miss the @sansforensics #DFIR Summit 2022 last week?

No worries! This is a curated list of links and resources brought to the #DFIRSummit attendees this year (Including mine ☺️)

https://t.co/VoruexnKGK

#CyberSec #InfoSec