← All Binaries

last

The command shows a list of user sessions including the user name, terminal used, host name, start and stop times, and duration. It also indicates if a session is still active or was terminated unexpectedly.

Discovery
Path
/usr/bin/last
Author
Will Huang (@In0de_16)
Created
2023-04-27

Example Use Cases 3

Enumerate the users who are currently logged into the system. #

The following command will display sessions that are currently active.

last | grep "still logged in"
Discovery T1033 onelineraccount

Enumerate all user accounts that have logged into the system previously. #

The last command can be used to output users who have previously logged in, by specifying the tty interface 'console'.

last -t console
Discovery T1033 onelineraccount

Enumerate all hosts that have remotely logged into the system before. #

An attacker can use 'last' with a filter to retrieve the connection date and remote host information for remote logins.

last | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
Discovery T1018 onelinernetwork

Detections

Resources