# last

> Show last user logins and TTYs.

The command shows a list of user sessions including the user name, terminal used, host name, start and stop times, and duration. It also indicates if a session is still active or was terminated unexpectedly.

- Page: https://loobins.io/binaries/last/
- Author: Will Huang (@In0de_16)
- Created: 2023-04-27
- Tactics: Discovery

## Paths

- `/usr/bin/last`

## Example Use Cases

### Enumerate the users who are currently logged into the system.

The following command will display sessions that are currently active.

```bash
last | grep "still logged in"
```

- Tactics: Discovery
- Tags: oneliner, account

### Enumerate all user accounts that have logged into the system previously.

The last command can be used to output users who have previously logged in, by specifying the tty interface 'console'.

```bash
last -t console
```

- Tactics: Discovery
- Tags: oneliner, account

### Enumerate all hosts that have remotely logged into the system before.

An attacker can use 'last' with a filter to retrieve the connection date and remote host information for remote logins.

```bash
last | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
```

- Tactics: Discovery
- Tags: oneliner, network

## Detections

- [System Network Connections Discovery](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml)

## Resources

- [last Man Page](https://ss64.com/osx/last.html)