Intelligencecollection
Record what the attacker actually did, in enough fidelity to replay and to extract from.
Collection runs for the whole session, and it does not stop at conversion. The behaviour after the swap is often the most useful part of the record, because that is where persistence, exfiltration attempts and pivot targets show up against backends that can safely absorb them.
The full PTY transcript is captured via asciinema, which is also what makes replay in the console a recording rather than an animation.
- Live session, before and after conversion
- PTY transcript
- Command sequence
- Tool fingerprints
- File operations
- Persistence attempts
- Pivot targets
- Payloads
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Capturing a PTY without disturbing it is one of the mechanisms being hand-built rather than generated. Getting it subtly wrong is visible to the attacker.