ubuntils v2.0.0 · forensic triage for Ubuntu: collect artifacts,…

Hey all,

I've been building ubuntils, a Python CLI/TUI for forensic triage on Ubuntu — the idea is to replace the "run the same 10 manual commands and hope you didn't miss one" first-30-minutes ritual of incident response with a single tool that does collection, detection, and timeline correlation automatically.

How it works (4 stages, ~3s total on a live host):

Collect — 11 collectors gather artifacts concurrently (processes, network, cron, systemd, SSH, sudoers, users, packages, PAM, kernel modules, environment)
Detect — 15 built-in rules (+ custom YAML rules if you want) run over everything, ranked by severity
Timeline — correlates syslog/journald/auditd chronologically and auto-attaches related events to each finding
Output — interactive 4-tab TUI (Summary/Findings/Timeline/Stats) or --json

What it catches: the usual suspects (cron persistence, LD_PRELOAD injection, suspicious systemd timers, new SSH keys, NOPASSWD sudoers, UID-0 backdoors) plus a newer "coverage pack" — tampered package files (dpkg --verify), immutable/append-only flag abuse, PAM/NSS backdoors, suspicious kernel modules, and unexpected setuid binaries.

New in v2.0.0 — offline collect/analyze split:

ubuntils collect grabs a tamper-evident bundle (hashed files + commands, SHA-256'd manifest) from a host with no detection running
ubuntils analyze bundle.tar.gz (or --root /mnt/image for a mounted image) runs the full detection/timeline pipeline later, elsewhere, without root
Bundle integrity is verified and reported (live / ok / mismatch)
Confidence scoring on findings (0–100, with an explainable signals breakdown) instead of a flat mtime heuristic
Docs are upfront about what offline analysis can't see compared to a live scan — no silently pretending it has parity

Also has:

Two-step remediation (dry-run by default, --confirm to apply) with automatic backups, symlink guards, and rollback commands — 5 of the 15 rules are auto-remediable, the rest are flag-only by design since they need a human to judge
Wazuh integration — if a Wazuh agent is present, findings get appended as JSON lines automatically, no flag needed
Zero network calls, ever — even dropped a planned VirusTotal hash-lookup feature to keep that guarantee absolute
90%+ test coverage, MIT licensed

sudo apt install pipx -y && pipx install -e . && sudo ubuntils scan

GitHub: https://github.com/asmitdesai/ubuntils

Feedback, bug reports, and PRs (especially new detection rules or collectors) very welcome — Discussions and issue templates are set up.

Impact

ubuntils improves incident response efficiency by automating the collection and analysis of forensic artifacts on Ubuntu systems, reducing human error and time spent during initial triage. It detects a range of persistence and tampering techniques that are commonly missed by other tools, providing ranked and confidence-scored findings. The tool does not introduce new vulnerabilities; rather, it enhances detection capabilities and supports guided remediation. There is no indication of exploitation or malicious activity associated with ubuntils itself.

Defensive guidance

This is a forensic and triage tool, not a vulnerability or exploit. No remediation is required for a security issue. Users should deploy ubuntils to improve forensic triage processes on Ubuntu systems. Follow installation instructions for Ubuntu 22.04+ using pipx or manual installation. Run ubuntils with appropriate privileges (root recommended) for full artifact access. Use the offline collect/analyze workflow when live scanning is not feasible. Utilize the built-in remediation features cautiously, applying changes only after review. No network connectivity is required or used by ubuntils, enhancing operational security.

Summary

ubuntils v2.0.0 is a forensic triage tool for Ubuntu that automates the collection of system artifacts, detection of persistence and tampering techniques, and correlation of events into a timeline. It runs in four stages: concurrent artifact collection from system components (processes, cron, systemd, SSH keys, sudoers, PAM, kernel modules, etc.), detection of 15 built-in persistence/tampering rules plus custom rules, timeline correlation of syslog/journald/auditd events, and output via an interactive TUI or JSON. The tool supports offline workflows by separating collection and analysis, verifying bundle integrity, and allowing analysis without root privileges. It provides confidence scoring for findings and supports partial automated remediation with rollback capabilities. ubuntils makes no network calls, ensuring offline operation, and integrates with Wazuh agents for reporting. It targets Ubuntu 22.04+ and is MIT licensed.

ubuntils v2.0.0 · forensic triage for Ubuntu: collect artifacts, correlate a timeline, and detect 15 persistence/tampering techniques (fully offline)

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 25 Sep 2026, 07:47 UTC

Technical details

References

Community reviews