Skip to content

Guides

03 · User Activity

Linux Shell History and User Activity Forensics

Reconstruct what a user did on a Linux host from bash, zsh and fish history, dotfiles, SSH files, sudo logs and account databases, and spot history evasion.

shell-historybashuser-activity
01 · Acquisition & Triage

Linux Triage Collection with UAC and Velociraptor

Run fast, repeatable Linux triage with UAC profiles and Velociraptor Linux artifacts: what each collects, offline collectors, hunts and what to grab first.

triageuacvelociraptor