CatalogLOOBins

ORCHARD · Tool

last

3 techniquesmacOSLOOBinsGPL-3.0

Enumerate the users who are currently logged into the system.

DiscoverymacOS

The following command will display sessions that are currently active.

last | grep "still logged in"
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery

Enumerate all user accounts that have logged into the system previously.

DiscoverymacOS

The last command can be used to output users who have previously logged in, by specifying the tty interface 'console'.

last -t console
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery

Enumerate all hosts that have remotely logged into the system before.

DiscoverymacOS

An attacker can use 'last' with a filter to retrieve the connection date and remote host information for remote logins.

last | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery