Rename root#436
Conversation
Detect running processes that inserted BPF filters in the Linux server
Fix typo
Fix yaml typo in spotlight.yaml
Update ss.yaml to show bpf filters
Add output and log filenames to the Azure Storage SAS URL. Fixes tclahr#389
The output and log file names are now automatically appended to the URL provided in `--azure-storage-sas-url` ([tclahr#389](tclahr#389)). Consequently, the `--azure-storage-sas-url-log-file` option is no longer needed and has been removed.
fix: update statx binaries
feat: add statf tool for FreeBSD based systems
Fix azure sas storage url
fix: parse special permissions in statx binary
Add an action to close stale pull requests older than 180 days.
artif: add binfmt_misc artifact
Resolved a bug that prevented proper artifact collection when the mountpoint of a mounted disk image included spaces or special characters.
Fix mount point with spaces
Add one more parameter as command was added to _find_based_collector function.
feat: find collectors may include a command to use with xargs
Add artifacts
artif: add additional possible persistence locations
Move artifact to a different artifact directory. Add changelog. Collect the SSH private key path only, and not the full key content.
Add System.map* to avml.yaml.
artif: collect /boot
fix: look for systemd journal only in /var/log
artif: collect SSH public keys, test secret keys for null passphrases
Not only is the new name more descriptive, it's a lot less hassle in both the "uac" code and also for later analysis. Signed-off-by: Hal Pomeranz <hrpomeranz@gmail.com>
|
Unit tests will need to be updated to account for the new directory name |
|
I decided to use The issue here is that some tools such as Cyber Triage, dissect... they might be using |
|
Regarding the dissect plugins it would be easy to change it. Let me know if you plan it one day (or I will probably see it). But I'm agree, the '[root]' name is now part of the UAC 'API' and is probably used in a lot of automation and changing it would be better in a major release. |
|
How much more code do I have to push in order for you to call it a major release? :-) |
5 participants
Renaming "[root]" to "collected_files" makes things easier in the
uaccode and also for analysts using the collected files.I'm not wedded to "collected_files" if you want to change the name to something else. There are only a very few spots in the
uacscript needed to make the change.This is apropos of Issue #435