last

The command shows a list of user sessions including the user name, terminal used, host name, start and stop times, and duration. It also indicates if a session is still active or was terminated unexpectedly.

Author: Will Huang (@In0de_16) Created: 2023-04-27

Discovery oneliner account network

Paths

/usr/bin/last

Example Use Cases

Enumerate the users who are currently logged into the system.

The following command will display sessions that are currently active.

last | grep "still logged in"

Discovery oneliner account

Enumerate all user accounts that have logged into the system previously.

The last command can be used to output users who have previously logged in, by specifying the tty interface 'console'.

last -t console

Discovery oneliner account

Enumerate all hosts that have remotely logged into the system before.

An attacker can use 'last' with a filter to retrieve the connection date and remote host information for remote logins.

last | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'

Discovery oneliner network

Detections

System Network Connections Discovery

Resources

last Man Page