Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh
The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of FSecure_Hostname-YYMMDD-HHMM.tar.gz
Once these are all aggregated and you have the FSecure_Hostname-YYMMDD-HHMM.tar.gz on the analysis machine. You can run Extract-Cat-Scale.sh which will extract all the files and place them in a folder called “extracted”.
user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh
Parsing
This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.
This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Both git fetch and git pull talk to a remote repository, but they do very different things to your…
Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…
Email is still one of the most important communication channels inside modern applications. Password resets,…
Nginx is a high-performance web server and reverse proxy trusted by some of the largest…
ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…
When you share a server with a team or investigate unexpected activity, the first question…