Live-state reference

Commands, embedded tools, and runtime limits.

Execution tasks capture volatile state through built-in collectors, operating-system commands, and—on Windows—executables embedded in Aralez itself.

Execution model

ProcInfo writes PID, parent PID and image name per process.
ProcDetailsInfo is the expensive one: per-process MD5 and SHA-256 of the image, loaded module list, working-set size, and a per-thread RWX/entropy injection check.
PortsInfo decodes the Windows TCP table only — there is no UDP equivalent.

Behavior	What the runtime does	Operational consequence
Scheduling	Entries in an execution task are submitted to a Rayon worker pool.	Commands in the same task can run concurrently; do not infer command order from YAML order.
Standard output	Captured and written to the configured `output_file`.	Use a unique output filename for every entry.
Standard error	Discarded by the system/external execution path.	A tool can fail without its diagnostic text appearing in the result; consult the Aralez log and reproduce locally.
Timeout	The task-level timeout is applied. On timeout Aralez terminates the Windows process/Job Object or the Unix process group.	The shipped Windows/Linux tasks use 60 seconds; macOS uses 120 seconds.
Memory limit	Windows external/system processes are placed in a Job Object with a memory cap. The Unix execution path does not currently enforce that cap.	Treat Linux/macOS `memory_limit` as descriptive, not an OS-enforced limit.
Size limit	Execution output uses the task/global collection limit. Entry-level `max_size` is not used by this path.	Do not depend on a per-command cap, even if a template contains that extra key.
Stream mode	System/external stdout is first held in memory, then added to the archive. Internal collectors write a temporary file, copy it into the archive, then remove it.	`--stream` reduces evidence-folder usage but does not make every command byte-for-byte streaming.

!

Template keys versus implemented keys

The macOS profile includes entry-level timeout and max_size on selected commands. Those fields are not part of the execution-entry schema and are ignored; the enclosing task timeout and task/global size limit control execution.

Windows shipped execution manifest

Embedded external tools

Sysinternals and optional WinPmem

autorunsc.exe -nobanner -c /accepteulaAutorunsc.txt

handle.exe /accepteula /a /nobannerHandle.txt

tcpvcon.exe /accepteula -aTCPvCon.txt

pslist.exe /accepteulaPSList.txt

Listdlls.exe /accepteulaListDLLs.txt

PsService.exe /accepteula queryPSService.txt

pipelist.exe /accepteulaPipeList.txt

winpmem.exe <output>memdump_log.txt + raw image

WinPmem belongs to the disabled priority-0 memory task and exists only in an extended-tools/memdump build.

Operating-system commands

Network, host, process, and services

netstat.exe -anobNetStat.txt

ipconfig.exe /allIPConfig.txt

ipconfig.exe /displaydnsDNSCache.txt

systeminfo.exeSystemInfo.txt

tasklist.exe /v /fo csvTaskList.csv

net.exe shareNetShare.csv

powershell -command Get-ComputerInfoComputerInfo.txt

Get-WinEvent … EventID 7045service path list

The service-event command links its stdout paths to the disabled-by-default linked collection task named services.

Internal collectors

No child executable required

ProcInfoProcInfo.txt

ProcDetailsInfoProcDetailsInfo.txt

PortsInfoPortsInfo.txt

Manage embedded Windows tools

Tool-management operations modify a copy of the executable and exit without collecting evidence. Run them on a trusted staging system, then verify and sign the resulting executable before deployment.

PowerShell

# Inventory embedded payloads
aralez.exe --list_tools

# Add or replace a tool and write a new collector
aralez.exe --add_tool C:\Staging\tool.exe C:\Build\aralez-custom.exe

# Remove a tool by embedded name and write a new collector
aralez.exe --remove_tool tool.exe C:\Build\aralez-without-tool.exe

Linux shipped execution manifest

System and time

ps -aux → ps.txt, find / … → file_list.txt, uname -a → uname.txt, hostnamectl → hostnamectl.txt, timedatectl → timedatectl.txt

Network and storage

netstat -tulnp, ss -tulnp, lsof -i, df -h, mount, ip a, ip r, iptables -L -v -n, nft list ruleset; output files use the command name, including ip_a.txt, ip_r.txt, and nftables.txt.

Identity and activity

getent passwd → users.txt, getent group → groups.txt, last, who, w, env, alias, and journalctl --no-pager.

Internal

ProcInfo → ProcInfo.csv, Network → Network.csv, Memory → Memory.txt, SystemInfo → SystemInfo.txt, PackageManager → PackageManager.txt.

The file-list command prunes /proc, /run, /sys, and /mnt, then records path, parent, filename, device, link, size, type, mode, link count, inode, group/user, and access/change/modify timestamps.

macOS shipped execution manifest

Identity, time, processes

sw_vers, system_profiler, hostname, uname, date, systemsetup -gettimezone, detailed ps, launchctl list, and launchctl dumpstate.

Network and disks

netstat, lsof, ifconfig, arp, route table, DNS cache, df, mount, diskutil list, diskutil apfs list, and local APFS snapshot inventory.

Users and platform security

Directory Service users/groups, last, who, kernel/system extensions, MDM profiles, firewall state/apps, SIP, Gatekeeper, FileVault status/users, remote-login state, and seven days of security-focused Unified Log records.

Software and internal collectors

Environment, installed packages/apps, Homebrew packages when present, ProcInfo → ProcInfo.csv, and ProcDetailsInfo → ProcDetailsInfo.csv.

Build capability matrix

Cargo feature	Adds	Notes
Default	Core collection and platform internal/system tools	No cloud/SFTP upload code and no extended Windows tool payload.
`extended-tools`	Extended Windows external tool payload, including WinPmem	Review binary size, tool licensing, and endpoint security controls.
`memdump`	Memory-dump capability	Includes `extended-tools`; the template memory task must also be enabled.
`upload-s3`	AWS S3 and S3-compatible dispatch	Required for `s3://`.
`upload-sftp`	SSH/SFTP dispatch	Required for `sftp://`.
`upload-smb`	SMB feature marker	The SMB dispatch module is compiled independently; the marker is retained for build selection.
`upload`	S3, SFTP, and SMB feature set	Convenience aggregate for upload-capable builds.

NextArchives & streaming→