The artifactcollector project provides a software that collects forensic artifacts on systems. These artifacts can be used in forensic investigations to understand attacker behavior on compromised computers.
The artifactcollector offers the following features
git clone https://github.com/forensicanalysis/artifactcollector
cd artifactcollector
go install .
If you want to extract the raw artifacts or process the collected data have a look.
git clone https://github.com/forensicanalysis/artifactcollector
.go generate
to download all artifacts.pack/artifacts
. Do not edit the artifact definitions, as they will be overwritten.pack/ac.yaml
and add the artifacts you want to collect.go generate
. This might yield some errors or problems in your artifacts.cp resources\artifactcollector.syso .
) to enable the icon for the executable and the UAC popup.go build .
to generates an executable.Binaries can be added to pack/bin
and than included into the artifactcollector in the go generate
step. Additionally a corresponding COMMAND artifact like the following is required.
name: Autoruns
sources:
- type: COMMAND
attributes:
cmd: autorunsc.exe
args: ["-x"]
supported_os: [Windows]
Currently the output to stdout and stderr is saved, but generated files are not collected.
Cross compilation is a bit more difficult, as a cross compiler like MinGW is required by CGO.
Example cross compilation for Windows:
CGO_ENABLED=1 CC=i686-w64-mingw32-gcc GOOS=windows GOARCH=386 go build .
CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc GOOS=windows GOARCH=amd64 go build .
Nmap (Network Mapper) is a free tool that helps you find devices on a network,…
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…