Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

artif: new artifacts to collect utmp and utmpdump results #298

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions artifacts/files/system/utmp.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
version: 1.0
artifacts:
-
description: Collect utmp file.
supported_os: [linux]
collector: file
path: /var/run/utmp
24 changes: 24 additions & 0 deletions artifacts/live_response/system/utmpdump.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
version: 1.0
condition: command_exists "utmpdump"
output_directory: /live_response/system
artifacts:
# utmpdump might be useful for detecting log file tampering.
# Reference: https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tampering/
-
description: Dump wtmp file in raw format.
supported_os: [linux]
collector: command
command: utmpdump /var/log/wtmp
output_file: utmpdump_wtmp.txt
-
description: Dump btmp file in raw format.
supported_os: [linux]
collector: command
command: utmpdump /var/log/btmp
output_file: utmpdump_btmp.txt
-
description: Dump utmp file in raw format.
supported_os: [linux]
collector: command
command: utmpdump /var/run/utmp
output_file: utmpdump_utmp.txt
Loading