Package: varc
varc (Volatile Artifact Collector)varc collects a snapshot of volatile data from a system.
It tells you what is happening on a system, and is of particular use when investigating a security incident.It creates a zip, which contains a number of different pieces of data to understand what is happening on a system:JSON files e.g. running processes and what network connections they are makingMemory of running proccesses, on a per-process basis. This is also carved to extract log and text data from memoryNetstat data of active connectionsThe contents of open files, for example running binariesDetails of which processes triggered a provided compiled YARA rule fileWe have successfully executed it across:WindowsLinuxOSXCloud environments such as AWS EC2Containerised Docker/Kubernetes environments such as AWS ECS/EKS/Fargate and Azure AKSEven serverless environments such as AWS LambdaCheck out the example captures under the "Releases" tab to see some crazy data!
The screen recording below shows a collection from a Docker container (left) and the output from running inside and AWS Lambda function which deployed Xmrig (right):In line with the order of volatility, we collect process memory before anything else. Note that varc, and any other tool that runs inside a system, will impact the memory of a system.Using as a compiled binaryYou can find compiled binaries for Windows, Linux and OSX under the Releases tab.
Simply execute and a zip is created with the output.
To access some data, you will need to run with elevated privileges (i.e. sudo or root on Linux).usage: varc [-h] [--skip-memory] [--skip-open] [--dump-extract] ...

optional arguments:
  -h, --help      show this help message and exit
  --skip-memory   Skip collecting process memory, which can be slow
  --skip-open     Skip collecting open files, which can be slow
  --dump-extract  Extract process memory dumps, which can be slowUsing as a Python libraryInstall from pip with:pip3 install varcOr alternatively, clone this repository then install with:python3 setup.py installThen call with:from varc import acquire_system
output_file_path = acquire_system().zip_pathAutomated Investigations and Responsevarc significantly simplifies the acquisition and analysis of volatile data.
Whilst it can be used manually on an ad-hoc basis, it is a great match for automatic deployment in response to security detections.
The output of varc is designed to be easily consumed by other tools, in standard JSON format as much as possible.A typical pipeline might be:A detection is fired from a detection toolvarc is deployed to collect and identify further activityFurther remediation actions are taken based on the analysis of varc outputWhy are the collected memory files empty?Process memory collection is not currently supported on OSX.If you run varc on a Linux system without the Ptrace Kernel capability enabled, you will get empty memory files.
You will still get detailed system output.For example, in our testing:AWS Lambda successfully dumped process memory by default.EKS on EC2 successfully dumped process memory by default.ECS on Fargate required us to enableCAP_SYS_PTRACEin our task definition.Using the collected dataAll data is saved in an open, non-propietary format in the hope it can easily be processed by other community tools.Our free toolCado Community Editionwill happily parse this zip, and display the JSON data tables as intended.Our commercial toolCado Responseadditionally enables you to automatically capture both static and volatile data from systems through Cado Host. By using the API, you can automatically investigate and respond to to detections from third party tools such as an EDR like SentinelOne or a cloud detection tool like GuardDuty.Here is an example of varc output for a Lambda function running xmrig, viewed inCado Community Edition:LicenseThis is licensed under the GPL. Please contact us if this does not work for your use case - we may be able to alternatively license under a non-copyleft license such as the Apache License. We're friendly!
As this software is licensed under the GPL and used in our commercial product, we ask any contributors to sign a simple Contributor License Agreement (CLA).LicenseWe would love any Pull Requests or Bug Reports!