bash 11 lines · 1 tab

Forensic collection script for volatile host evidence

Kai Nakamura Apr 2026

1 tab

#!/usr/bin/env bash
set -euo pipefail

OUT="/tmp/incident-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"

date -u > "$OUT/time.txt"
ps auxww > "$OUT/processes.txt"
ss -tunap > "$OUT/network.txt"
last -n 50 > "$OUT/logins.txt"
journalctl -n 500 --no-pager > "$OUT/journal.txt"

1 file · bash Explain with highlit

During incidents I want a repeatable evidence collection script that preserves volatile context before a system changes again. Time, network state, processes, and recent logs usually matter immediately. Good collection is quiet, timestamped, and resistant to operator improvisation under stress.

Related snips

python

import os
import stat

for root, _dirs, files in os.walk('/etc'):
    for name in files:
        path = os.path.join(root, name)

Python security audit script for exposed risky filesystem state

python auditing host-security

by Kai Nakamura 1 tab

plaintext

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

SSH daemon hardening and key based access only

ssh linux hardening

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

find / -perm -4000 -type f 2>/dev/null | sort
sudo -l
find /etc/systemd/system -type f -writable 2>/dev/null

Linux privilege escalation checks for suspicious local state

privilege-escalation linux auditing

by Kai Nakamura 1 tab

plaintext

rule SuspiciousDownloader {
  strings:
    $a = "powershell -enc" nocase
    $b = "Invoke-WebRequest" nocase
    $c = "http://" nocase
  condition:

YARA rules for spotting suspicious binaries during triage

yara malware triage

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

# ==========================================================
# Production Incident Response Runbook
# ==========================================================

Incident response runbook and diagnostic scripts

incident-response sre production

by Ryan Nakamura 1 tab

yaml

severities:
  sev1: customer-impacting active compromise or confirmed data exposure
  sev2: high risk suspicious activity with potential customer impact
  sev3: contained issue with low current impact

first_hour:

Incident response severity matrix and first hour checklist

incident-response runbooks security-operations

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Forensic collection script for volatile host evidence — share card

Link copied