Operational guidance

Treat collection as privileged evidence handling.

Aralez runs with broad access, can package sensitive material, may embed third-party tools, and can move evidence off-host. Govern the binary, profile, credentials, and result as one chain.

Before field use

i

The infected convention

The shipped Windows profile sets encrypt: "infected" on its suspicious-file entries. That password is a long-standing malware-handling convention: it keeps samples from being executed by accident on an analyst workstation, and stops AV and mail gateways from quarantining or stripping the archive in transit. Change it for anything other than sample transport.

Authority Confirm legal and organizational authority for every data category and endpoint. Scope Minimize the profile to the incident hypothesis and retention policy. Provenance Build reproducibly where possible; record source commit, features, binary hash, and tool hashes. Destination Use authenticated, encrypted transport and a write-restricted evidence principal. Capacity Validate endpoint and collector disk, memory, network, and object-size constraints. Recovery Test interrupted runs, failed uploads, partial fleet completion, and duplicate output names.

Secrets

Do not embed reusable storage or SSH passwords in broadly distributed profiles.
Prefer IAM/workload identities, short-lived credentials, tightly scoped keys, or a dedicated SSH agent identity.
Be aware that CLI arguments may be visible to local process inspection and management tooling.
The --show_config output exposes everything stored in the embedded YAML.

Integrity and chain of custody

Aralez does not currently produce a signed manifest or archive checksum as part of the documented finalization path. Add hashing and evidence registration immediately after collection or at the receiving system.

PowerShell

Get-FileHash Aralez_HOST_*.zip -Algorithm SHA256 |
  Format-List | Out-File Aralez_HOST.sha256

bash

sha256sum Aralez_HOST_*.zip | tee Aralez_HOST.sha256
# macOS alternative
shasum -a 256 Aralez_HOST_*.tar.zst | tee Aralez_HOST.sha256

Endpoint impact

Collection changes access times on filesystems or through APIs depending on platform behavior, executes commands, creates temporary files, consumes I/O, and may launch embedded utilities. Stream mode reduces intermediate storage but does not make collection “invisible” or memory-only. Validate forensic implications for your environment and tooling.

!

No automatic authenticity claim

A finalized archive is not by itself proof of authenticity. Combine controlled binaries, logged execution, trusted time, secure transfer, hashes, access control, and case documentation.

Third-party tools

Windows builds may include Microsoft Sysinternals utilities and optionally WinPmem. Verify download sources, signatures, versions, license terms, endpoint-security allowances, and expected detections before distribution.

NextTroubleshooting→