ubuntils v2.0.0 – forensic triage for Ubuntu: collect artifacts, correlate a timeline, and detect 15 persistence/tampering techniques (fully offline)
ubuntils v2.0.0 is a Python-based forensic triage tool for live Ubuntu systems designed to automate artifact collection, persistence detection, and timeline correlation. It replaces manual incident response commands with a fast, automated process that collects data from multiple system sources, detects 15 persistence and tampering techniques, and correlates events into a timeline. The tool supports offline analysis by splitting collection and analysis phases, includes confidence scoring for findings, and offers guided remediation with dry-run and confirm modes. It integrates with Wazuh for automated reporting and operates fully offline without network calls. ubuntils aims to improve the speed and accuracy of initial forensic triage on Ubuntu hosts.
AI Analysis
Technical Summary
ubuntils v2.0.0 is a forensic triage tool for Ubuntu that automates the collection of system artifacts, detection of persistence and tampering techniques, and correlation of events into a timeline. It runs in four stages: concurrent artifact collection from system components (processes, cron, systemd, SSH keys, sudoers, PAM, kernel modules, etc.), detection of 15 built-in persistence/tampering rules plus custom rules, timeline correlation of syslog/journald/auditd events, and output via an interactive TUI or JSON. The tool supports offline workflows by separating collection and analysis, verifying bundle integrity, and allowing analysis without root privileges. It provides confidence scoring for findings and supports partial automated remediation with rollback capabilities. ubuntils makes no network calls, ensuring offline operation, and integrates with Wazuh agents for reporting. It targets Ubuntu 22.04+ and is MIT licensed.
Potential Impact
ubuntils improves incident response efficiency by automating the collection and analysis of forensic artifacts on Ubuntu systems, reducing human error and time spent during initial triage. It detects a range of persistence and tampering techniques that are commonly missed by other tools, providing ranked and confidence-scored findings. The tool does not introduce new vulnerabilities; rather, it enhances detection capabilities and supports guided remediation. There is no indication of exploitation or malicious activity associated with ubuntils itself.
Mitigation Recommendations
This is a forensic and triage tool, not a vulnerability or exploit. No remediation is required for a security issue. Users should deploy ubuntils to improve forensic triage processes on Ubuntu systems. Follow installation instructions for Ubuntu 22.04+ using pipx or manual installation. Run ubuntils with appropriate privileges (root recommended) for full artifact access. Use the offline collect/analyze workflow when live scanning is not feasible. Utilize the built-in remediation features cautiously, applying changes only after review. No network connectivity is required or used by ubuntils, enhancing operational security.
ubuntils v2.0.0 – forensic triage for Ubuntu: collect artifacts, correlate a timeline, and detect 15 persistence/tampering techniques (fully offline)
Description
ubuntils v2.0.0 is a Python-based forensic triage tool for live Ubuntu systems designed to automate artifact collection, persistence detection, and timeline correlation. It replaces manual incident response commands with a fast, automated process that collects data from multiple system sources, detects 15 persistence and tampering techniques, and correlates events into a timeline. The tool supports offline analysis by splitting collection and analysis phases, includes confidence scoring for findings, and offers guided remediation with dry-run and confirm modes. It integrates with Wazuh for automated reporting and operates fully offline without network calls. ubuntils aims to improve the speed and accuracy of initial forensic triage on Ubuntu hosts.
Reddit Discussion
Hey all,
I've been building ubuntils, a Python CLI/TUI for forensic triage on Ubuntu — the idea is to replace the "run the same 10 manual commands and hope you didn't miss one" first-30-minutes ritual of incident response with a single tool that does collection, detection, and timeline correlation automatically.
How it works (4 stages, ~3s total on a live host):
- Collect — 11 collectors gather artifacts concurrently (processes, network, cron, systemd, SSH, sudoers, users, packages, PAM, kernel modules, environment)
- Detect — 15 built-in rules (+ custom YAML rules if you want) run over everything, ranked by severity
- Timeline — correlates syslog/journald/auditd chronologically and auto-attaches related events to each finding
- Output — interactive 4-tab TUI (Summary/Findings/Timeline/Stats) or
--json
What it catches: the usual suspects (cron persistence, LD_PRELOAD injection, suspicious systemd timers, new SSH keys, NOPASSWD sudoers, UID-0 backdoors) plus a newer "coverage pack" — tampered package files (dpkg --verify), immutable/append-only flag abuse, PAM/NSS backdoors, suspicious kernel modules, and unexpected setuid binaries.
New in v2.0.0 — offline collect/analyze split:
ubuntils collectgrabs a tamper-evident bundle (hashed files + commands, SHA-256'd manifest) from a host with no detection runningubuntils analyze bundle.tar.gz(or--root /mnt/imagefor a mounted image) runs the full detection/timeline pipeline later, elsewhere, without root- Bundle integrity is verified and reported (
live/ok/mismatch) - Confidence scoring on findings (0–100, with an explainable signals breakdown) instead of a flat mtime heuristic
- Docs are upfront about what offline analysis can't see compared to a live scan — no silently pretending it has parity
Also has:
- Two-step remediation (dry-run by default,
--confirmto apply) with automatic backups, symlink guards, and rollback commands — 5 of the 15 rules are auto-remediable, the rest are flag-only by design since they need a human to judge - Wazuh integration — if a Wazuh agent is present, findings get appended as JSON lines automatically, no flag needed
- Zero network calls, ever — even dropped a planned VirusTotal hash-lookup feature to keep that guarantee absolute
- 90%+ test coverage, MIT licensed
sudo apt install pipx -y && pipx install -e . && sudo ubuntils scan GitHub: https://github.com/asmitdesai/ubuntils
Feedback, bug reports, and PRs (especially new detection rules or collectors) very welcome — Discussions and issue templates are set up.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ubuntils v2.0.0 is a forensic triage tool for Ubuntu that automates the collection of system artifacts, detection of persistence and tampering techniques, and correlation of events into a timeline. It runs in four stages: concurrent artifact collection from system components (processes, cron, systemd, SSH keys, sudoers, PAM, kernel modules, etc.), detection of 15 built-in persistence/tampering rules plus custom rules, timeline correlation of syslog/journald/auditd events, and output via an interactive TUI or JSON. The tool supports offline workflows by separating collection and analysis, verifying bundle integrity, and allowing analysis without root privileges. It provides confidence scoring for findings and supports partial automated remediation with rollback capabilities. ubuntils makes no network calls, ensuring offline operation, and integrates with Wazuh agents for reporting. It targets Ubuntu 22.04+ and is MIT licensed.
Potential Impact
ubuntils improves incident response efficiency by automating the collection and analysis of forensic artifacts on Ubuntu systems, reducing human error and time spent during initial triage. It detects a range of persistence and tampering techniques that are commonly missed by other tools, providing ranked and confidence-scored findings. The tool does not introduce new vulnerabilities; rather, it enhances detection capabilities and supports guided remediation. There is no indication of exploitation or malicious activity associated with ubuntils itself.
Defensive Guidance
This is a forensic and triage tool, not a vulnerability or exploit. No remediation is required for a security issue. Users should deploy ubuntils to improve forensic triage processes on Ubuntu systems. Follow installation instructions for Ubuntu 22.04+ using pipx or manual installation. Run ubuntils with appropriate privileges (root recommended) for full artifact access. Use the offline collect/analyze workflow when live scanning is not feasible. Utilize the built-in remediation features cautiously, applying changes only after review. No network connectivity is required or used by ubuntils, enhancing operational security.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ab6271df7a7c54106807fb8
Added to database: 09/25/2026, 07:47:41 UTC
Last enriched: 09/25/2026, 07:47:47 UTC
Last updated: 09/26/2026, 03:47:36 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.