Fast Unix-like Incident Response Triage Using UAC Tool

Подробнее о видео

SANS DFIR Summit 2022

Speaker: Thiago Canozza Lahr

Do you know how to locate, identify and collect relevant artifacts from Unix-like systems such as AIX, BSDs, ESXi, Linux, macOS, and Solaris? Reserve your seat and join me in this presentation where I will show you how to perform a quick artifact collection on different Unix-like operating systems using UAC (Unix-like Artifacts Collector) tool. UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of Unix-like systems artifacts.

View upcoming Summits:
Download the presentation slides (SANS account required) at